Warning: Permanently added '[localhost]:46062' (ECDSA) to the list of known hosts. 2025/08/29 18:57:02 fuzzer started 2025/08/29 18:57:03 dialing manager at localhost:43077 syzkaller login: [ 59.630521] cgroup: Unknown subsys name 'net' [ 59.695178] cgroup: Unknown subsys name 'cpuset' [ 59.711310] cgroup: Unknown subsys name 'rlimit' 2025/08/29 18:57:14 syscalls: 201 2025/08/29 18:57:14 code coverage: enabled 2025/08/29 18:57:14 comparison tracing: enabled 2025/08/29 18:57:14 extra coverage: enabled 2025/08/29 18:57:14 setuid sandbox: enabled 2025/08/29 18:57:14 namespace sandbox: enabled 2025/08/29 18:57:14 Android sandbox: enabled 2025/08/29 18:57:14 fault injection: enabled 2025/08/29 18:57:14 leak checking: enabled 2025/08/29 18:57:14 net packet injection: enabled 2025/08/29 18:57:14 net device setup: enabled 2025/08/29 18:57:14 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 18:57:14 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 18:57:14 USB emulation: enabled 2025/08/29 18:57:14 hci packet injection: enabled 2025/08/29 18:57:14 wifi device emulation: enabled 2025/08/29 18:57:14 802.15.4 emulation: enabled 2025/08/29 18:57:14 fetching corpus: 0, signal 0/0 (executing program) 2025/08/29 18:57:15 starting 8 fuzzer processes 18:57:15 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:57:15 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) pipe(&(0x7f0000000c40)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r12, 0x89f5, &(0x7f0000000d00)={'ip6_vti0\x00', &(0x7f0000000c80)={'ip6tnl0\x00', r2, 0x4, 0x16, 0xcb, 0x5, 0x31, @empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, 0x80, 0x40, 0x3, 0x5546d3b3}}) 18:57:15 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) io_uring_register$IORING_UNREGISTER_PERSONALITY(r2, 0xa, 0x0, 0x0) 18:57:15 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) r2 = socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r4 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r4, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r5, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r3, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r4) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r6 = socket(0x3, 0x1, 0x3) r7 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) r8 = io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r7}) ioctl$SNAPSHOT_FREE_SWAP_PAGES(0xffffffffffffffff, 0x3309) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000001a40)=[r3, r6, r7, r8], 0x4) 18:57:15 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x8) 18:57:15 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 18:57:15 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r6, 0x40043311, &(0x7f00000004c0)) ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000540)) [ 71.159599] audit: type=1400 audit(1756493835.760:7): avc: denied { execmem } for pid=274 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 18:57:15 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r2, 0x8008330e, &(0x7f0000000400)) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x2c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x20000014) [ 72.290471] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.294252] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.296208] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.301690] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.305059] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.415410] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.421311] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.423660] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.427546] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.430253] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.488578] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.494343] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.495862] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.509517] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.513637] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.544554] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.548760] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.555751] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.558976] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 72.562644] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 72.567500] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.568667] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.579378] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.579423] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.587522] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 72.592787] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 72.594246] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 72.600665] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 72.608818] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 72.622940] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 72.624527] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 72.625326] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 72.626104] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 72.628112] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 72.639165] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 72.644886] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 72.649889] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 72.655616] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 72.684262] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 72.686731] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 74.324527] Bluetooth: hci0: command tx timeout [ 74.453072] Bluetooth: hci1: command tx timeout [ 74.580295] Bluetooth: hci2: command tx timeout [ 74.644344] Bluetooth: hci3: command tx timeout [ 74.708521] Bluetooth: hci5: command tx timeout [ 74.709318] Bluetooth: hci4: command tx timeout [ 74.709976] Bluetooth: hci7: command tx timeout [ 74.710824] Bluetooth: hci6: command tx timeout [ 76.372585] Bluetooth: hci0: command tx timeout [ 76.501144] Bluetooth: hci1: command tx timeout [ 76.631034] Bluetooth: hci2: command tx timeout [ 76.693236] Bluetooth: hci3: command tx timeout [ 76.756121] Bluetooth: hci4: command tx timeout [ 76.756536] Bluetooth: hci5: command tx timeout [ 76.759167] Bluetooth: hci7: command tx timeout [ 76.759572] Bluetooth: hci6: command tx timeout [ 78.420066] Bluetooth: hci0: command tx timeout [ 78.548188] Bluetooth: hci1: command tx timeout [ 78.677681] Bluetooth: hci2: command tx timeout [ 78.741048] Bluetooth: hci3: command tx timeout [ 78.804182] Bluetooth: hci6: command tx timeout [ 78.804584] Bluetooth: hci7: command tx timeout [ 78.804964] Bluetooth: hci5: command tx timeout [ 78.805449] Bluetooth: hci4: command tx timeout [ 80.468103] Bluetooth: hci0: command tx timeout [ 80.596375] Bluetooth: hci1: command tx timeout [ 80.724337] Bluetooth: hci2: command tx timeout [ 80.788278] Bluetooth: hci3: command tx timeout [ 80.852356] Bluetooth: hci5: command tx timeout [ 80.853388] Bluetooth: hci4: command tx timeout [ 80.854628] Bluetooth: hci7: command tx timeout [ 80.855502] Bluetooth: hci6: command tx timeout [ 111.311608] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.312346] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.531128] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.531758] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.060295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.060942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.236095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.236688] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.328944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.329672] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.487518] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.488204] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:57:57 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) r2 = socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r4 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r4, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r5, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r3, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r4) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r6 = socket(0x3, 0x1, 0x3) r7 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) r8 = io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r7}) ioctl$SNAPSHOT_FREE_SWAP_PAGES(0xffffffffffffffff, 0x3309) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000001a40)=[r3, r6, r7, r8], 0x4) [ 112.641730] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.642995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.752254] audit: type=1400 audit(1756493877.352:8): avc: denied { kernel } for pid=3867 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 18:57:57 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) io_uring_register$IORING_UNREGISTER_PERSONALITY(r2, 0xa, 0x0, 0x0) [ 112.804554] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.805177] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:57:57 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) io_uring_register$IORING_UNREGISTER_PERSONALITY(r2, 0xa, 0x0, 0x0) 18:57:57 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x8) [ 112.942405] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.943670] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 18:57:57 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) io_uring_register$IORING_UNREGISTER_PERSONALITY(r2, 0xa, 0x0, 0x0) 18:57:57 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) r2 = socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r4 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r4, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r5, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r3, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r4) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r6 = socket(0x3, 0x1, 0x3) r7 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) r8 = io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r7}) ioctl$SNAPSHOT_FREE_SWAP_PAGES(0xffffffffffffffff, 0x3309) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000001a40)=[r3, r6, r7, r8], 0x4) 18:57:57 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x8) 18:57:57 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 113.072032] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.072610] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.131077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.131767] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.234617] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.235295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.266541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.267162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.332155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.332895] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.199385] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 114.200486] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 114.208339] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 114.210319] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 114.210910] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 114.212894] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 114.214829] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 114.215811] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 114.217884] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 114.220294] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 114.220833] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 114.223952] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 114.226759] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 114.228634] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 114.231901] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 114.234591] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 114.235278] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 114.237966] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 114.240029] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 114.241677] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 114.244302] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 114.246121] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 114.246628] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 114.248385] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 114.253129] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 114.255235] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 114.256502] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 114.257233] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 114.258319] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 114.259348] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 114.259958] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 114.261620] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 114.298475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.299134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.367178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.367868] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.308144] Bluetooth: hci7: command 0x0c1a tx timeout [ 116.309285] Bluetooth: hci6: command 0x0c1a tx timeout [ 116.310315] Bluetooth: hci5: command 0x0c1a tx timeout [ 116.310349] Bluetooth: hci4: command 0x0c1a tx timeout [ 116.311326] Bluetooth: hci3: command 0x0c1a tx timeout [ 116.311868] Bluetooth: hci2: command 0x0c1a tx timeout [ 116.312849] Bluetooth: hci1: command 0x0c1a tx timeout [ 116.313356] Bluetooth: hci0: command 0x0c1a tx timeout [ 118.356628] Bluetooth: hci2: command 0x0c1a tx timeout [ 118.357168] Bluetooth: hci0: command 0x0c1a tx timeout [ 118.357280] Bluetooth: hci1: command 0x0c1a tx timeout [ 118.357582] Bluetooth: hci3: command 0x0c1a tx timeout [ 118.358661] Bluetooth: hci7: command 0x0c1a tx timeout [ 118.358987] Bluetooth: hci6: command 0x0c1a tx timeout [ 118.359952] Bluetooth: hci4: command 0x0c1a tx timeout [ 118.360306] Bluetooth: hci5: command 0x0c1a tx timeout [ 120.404214] Bluetooth: hci5: command 0x0c1a tx timeout [ 120.404255] Bluetooth: hci7: command 0x0c1a tx timeout [ 120.404296] Bluetooth: hci1: command 0x0c1a tx timeout [ 120.405409] Bluetooth: hci4: command 0x0c1a tx timeout [ 120.405759] Bluetooth: hci6: command 0x0c1a tx timeout [ 120.406707] Bluetooth: hci3: command 0x0c1a tx timeout [ 120.407079] Bluetooth: hci2: command 0x0c1a tx timeout [ 120.407999] Bluetooth: hci0: command 0x0c1a tx timeout 18:58:09 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x8) 18:58:09 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:09 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:09 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) r2 = socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r4 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r4, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r5, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r3, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r4) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r6 = socket(0x3, 0x1, 0x3) r7 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) r8 = io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r7}) ioctl$SNAPSHOT_FREE_SWAP_PAGES(0xffffffffffffffff, 0x3309) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000001a40)=[r3, r6, r7, r8], 0x4) 18:58:09 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) pipe(&(0x7f0000000c40)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r12, 0x89f5, &(0x7f0000000d00)={'ip6_vti0\x00', &(0x7f0000000c80)={'ip6tnl0\x00', r2, 0x4, 0x16, 0xcb, 0x5, 0x31, @empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, 0x80, 0x40, 0x3, 0x5546d3b3}}) 18:58:09 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 18:58:09 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r2, 0x8008330e, &(0x7f0000000400)) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x2c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x20000014) 18:58:09 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r6, 0x40043311, &(0x7f00000004c0)) ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000540)) 18:58:09 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r2, 0x8008330e, &(0x7f0000000400)) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x2c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x20000014) 18:58:09 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 18:58:09 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:09 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 126.010058] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 126.011638] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 126.013374] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 126.015375] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 126.016586] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 126.017987] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 126.019255] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 126.020641] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 127.252169] Bluetooth: hci0: command 0x0c1a tx timeout [ 128.020117] Bluetooth: hci6: command 0x0c1a tx timeout [ 128.021232] Bluetooth: hci5: command 0x0c1a tx timeout [ 128.022260] Bluetooth: hci4: command 0x0c1a tx timeout [ 128.023274] Bluetooth: hci3: command 0x0c1a tx timeout [ 128.024274] Bluetooth: hci2: command 0x0c1a tx timeout [ 128.025307] Bluetooth: hci1: command 0x0c1a tx timeout [ 128.084121] Bluetooth: hci7: command 0x0c1a tx timeout 18:58:20 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:20 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r6, 0x40043311, &(0x7f00000004c0)) ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000540)) 18:58:20 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 18:58:20 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:20 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) socket(0x3, 0x1, 0x3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) ioctl$SNAPSHOT_FREE_SWAP_PAGES(0xffffffffffffffff, 0x3309) 18:58:20 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) pipe(&(0x7f0000000c40)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r12, 0x89f5, &(0x7f0000000d00)={'ip6_vti0\x00', &(0x7f0000000c80)={'ip6tnl0\x00', r2, 0x4, 0x16, 0xcb, 0x5, 0x31, @empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, 0x80, 0x40, 0x3, 0x5546d3b3}}) 18:58:20 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000440)={0x1, 0x80, 0xce, 0x7f, 0x9, 0x7f, 0x0, 0xff, 0x4003, 0x8, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x65, 0x0, @perf_bp={&(0x7f0000000400), 0x4}, 0x40204, 0x7c, 0x6ccc, 0x0, 0x100000000, 0xffff, 0x1, 0x0, 0x3e, 0x0, 0x1ffc00000000}) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:20 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r2, 0x8008330e, &(0x7f0000000400)) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x2c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010101}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x20000014) 18:58:20 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r2, 0x8008330e, &(0x7f0000000400)) 18:58:20 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x2) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:20 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:20 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) 18:58:20 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r2, 0x3309) 18:58:20 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) perf_event_open$cgroup(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x6, 0x3, 0x80, 0x0, 0xe1, 0x402, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xf48, 0x1, @perf_bp={&(0x7f0000000340), 0x4}, 0x54, 0x79b00000000000, 0xb98, 0x7, 0x5, 0x2, 0x40, 0x0, 0xff, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:20 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:20 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:58:20 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) [ 136.578080] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 136.580423] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 136.581977] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 136.584972] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 136.586599] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 136.589118] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 136.590887] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 136.592951] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 137.812121] Bluetooth: hci0: command 0x0c1a tx timeout [ 138.644208] Bluetooth: hci7: command 0x0c1a tx timeout [ 138.644929] Bluetooth: hci6: command 0x0c1a tx timeout [ 138.645620] Bluetooth: hci5: command 0x0c1a tx timeout [ 138.646188] Bluetooth: hci4: command 0x0c1a tx timeout [ 138.646305] Bluetooth: hci3: command 0x0c1a tx timeout [ 138.647308] Bluetooth: hci2: command 0x0c1a tx timeout [ 138.647895] Bluetooth: hci1: command 0x0c1a tx timeout 18:58:29 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r6, 0x40043311, &(0x7f00000004c0)) ioctl$HIDIOCGPHYS(0xffffffffffffffff, 0x80404812, &(0x7f0000000540)) 18:58:29 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) accept(r0, 0x0, &(0x7f0000001900)) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:58:29 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) socket(0x3, 0x1, 0x3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:58:29 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "b7d8f47c488d91e7", "22a25ad35e4bb1daaba5db34c70cab01", "15c392a5", "dd9d3d9bc54c2e09"}, 0x28) 18:58:29 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) pipe(&(0x7f0000000c40)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r12, 0x89f5, &(0x7f0000000d00)={'ip6_vti0\x00', &(0x7f0000000c80)={'ip6tnl0\x00', r2, 0x4, 0x16, 0xcb, 0x5, 0x31, @empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, 0x80, 0x40, 0x3, 0x5546d3b3}}) 18:58:29 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000300)) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:29 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = accept4(r5, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r7, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r9 = socket(0x1, 0x6, 0x9) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r9) r11 = openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r9, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r8, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r11, &(0x7f0000000b80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a80)={0xc0, r10, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000004}, 0xc41) 18:58:29 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$HIDIOCSFLAG(r0, 0x4004480f, &(0x7f0000000500)=0x1) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:29 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = accept4(r4, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r6, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r8 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r8) openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r8, 0x89f6, &(0x7f0000000a40)={'syztnl0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r7, 0x29, 0x0, 0x7, 0x8, 0x9, @mcast2, @private1, 0x700, 0x40, 0x7ff, 0x3}}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r9}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:29 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000002c0)=r2, 0x1) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:29 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000280)={0x2, 0x200, 0x7e00000}) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 145.077140] kmemleak: Found object by alias at 0x607f1a63974c [ 145.077174] CPU: 1 UID: 0 PID: 4092 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 145.077208] Tainted: [W]=WARN [ 145.077215] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 145.077228] Call Trace: [ 145.077235] [ 145.077244] dump_stack_lvl+0xca/0x120 [ 145.077285] __lookup_object+0x94/0xb0 [ 145.077316] delete_object_full+0x27/0x70 [ 145.077346] free_percpu+0x30/0x1160 [ 145.077376] ? arch_uprobe_clear_state+0x16/0x140 [ 145.077414] futex_hash_free+0x38/0xc0 [ 145.077439] mmput+0x2d3/0x390 [ 145.077475] do_exit+0x79d/0x2970 [ 145.077500] ? lock_release+0xc8/0x290 [ 145.077531] ? __pfx_do_exit+0x10/0x10 [ 145.077558] ? find_held_lock+0x2b/0x80 [ 145.077591] ? get_signal+0x835/0x2340 [ 145.077628] do_group_exit+0xd3/0x2a0 [ 145.077657] get_signal+0x2315/0x2340 [ 145.077700] ? __pfx_get_signal+0x10/0x10 [ 145.077732] ? do_futex+0x135/0x370 [ 145.077758] ? __pfx_do_futex+0x10/0x10 [ 145.077787] ? lock_acquire+0x15e/0x2f0 [ 145.077817] arch_do_signal_or_restart+0x80/0x790 [ 145.077849] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 145.077880] ? __x64_sys_futex+0x1c9/0x4d0 [ 145.077904] ? __x64_sys_futex+0x1d2/0x4d0 [ 145.077930] ? __fget_files+0x20d/0x3b0 [ 145.077952] ? __pfx___x64_sys_futex+0x10/0x10 [ 145.077982] ? fdget+0x197/0x220 [ 145.078005] exit_to_user_mode_loop+0x8b/0x110 [ 145.078029] do_syscall_64+0x2f7/0x360 [ 145.078052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.078074] RIP: 0033:0x7fe7093d8b19 [ 145.078090] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 145.078100] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 145.078122] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 145.078137] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 145.078150] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 145.078163] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 145.078177] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 145.078207] [ 145.078214] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 145.078227] kmemleak: comm "syz-executor.3", pid 4098, jiffies 4294811872 [ 145.078240] kmemleak: min_count = 1 [ 145.078248] kmemleak: count = 0 [ 145.078255] kmemleak: flags = 0x21 [ 145.078262] kmemleak: checksum = 0 [ 145.078269] kmemleak: backtrace: [ 145.078275] pcpu_alloc_noprof+0x87a/0x1170 [ 145.078304] percpu_ref_init+0x37/0x400 [ 145.078337] io_uring_setup+0x44c/0x2000 [ 145.078358] __x64_sys_io_uring_setup+0xc8/0x170 [ 145.078379] do_syscall_64+0xbf/0x360 [ 145.078395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.708185] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 145.709522] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 145.710825] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 145.712137] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 145.713385] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 145.714665] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 145.715890] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 145.717164] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 146.900218] Bluetooth: hci0: command 0x0c1a tx timeout [ 147.732173] Bluetooth: hci7: command 0x0c1a tx timeout [ 147.733288] Bluetooth: hci6: command 0x0c1a tx timeout [ 147.734292] Bluetooth: hci5: command 0x0c1a tx timeout [ 147.735267] Bluetooth: hci4: command 0x0c1a tx timeout [ 147.735318] Bluetooth: hci3: command 0x0c1a tx timeout [ 147.736279] Bluetooth: hci2: command 0x0c1a tx timeout [ 147.737116] Bluetooth: hci1: command 0x0c1a tx timeout 18:58:40 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r3 = eventfd2(0xff, 0x800) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000240)=r3, 0x1) r4 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r4, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:40 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) 18:58:40 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r6, 0x40043311, &(0x7f00000004c0)) 18:58:40 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) pipe(&(0x7f0000000c40)) 18:58:40 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) r3 = accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = accept4(r4, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r6, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r7 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r7) openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) getpeername(r3, &(0x7f0000000900)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000980)=0x80) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:40 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) socket(0x3, 0x1, 0x3) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 18:58:40 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000018c0)=[r1, r3], 0x2) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:58:40 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:40 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r4, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r5, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r6 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r6) openat$null(0xffffffffffffff9c, &(0x7f00000007c0), 0x44800, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:40 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000380)) 18:58:40 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) eventfd2(0xff, 0x800) r2 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r2, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:40 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r6 = openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f00000004c0)=[r2, r5, r3, r1, r6, 0xffffffffffffffff, r7], 0x7) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r8, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:40 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0x4000, 0x0) r2 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r2, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 156.524705] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.526316] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.528680] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.529844] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.532896] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.534850] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 156.536428] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 156.538586] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 157.716082] Bluetooth: hci0: command 0x0c1a tx timeout [ 158.548247] Bluetooth: hci7: command 0x0c1a tx timeout [ 158.548347] Bluetooth: hci6: command 0x0c1a tx timeout [ 158.549123] Bluetooth: hci5: command 0x0c1a tx timeout [ 158.550233] Bluetooth: hci4: command 0x0c1a tx timeout [ 158.550889] Bluetooth: hci3: command 0x0c1a tx timeout [ 158.551928] Bluetooth: hci2: command 0x0c1a tx timeout [ 158.552710] Bluetooth: hci1: command 0x0c1a tx timeout 18:58:51 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r4, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r5, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r6 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:51 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r3) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:58:51 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000001c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r2 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r2, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:51 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x440000, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r4, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:51 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x30, 0x0, 0x5cb45ba039aac722, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x1) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:58:51 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r0, 0x3312, 0x86) pipe(&(0x7f0000000340)) 18:58:51 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000c00)={'syztnl2\x00', &(0x7f0000000b80)={'ip6_vti0\x00', r11, 0x2f, 0x4, 0x1, 0x5, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0xffff, 0xc7b}}) 18:58:51 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) socket(0x3, 0x1, 0x3) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 18:58:51 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x40}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000011) pipe(&(0x7f0000000340)) 18:58:51 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x2, 0x80, 0x0, 0x7f, 0x0, 0xc76, 0x20404, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x61cc, 0x4, @perf_bp={&(0x7f0000000100)}, 0x100, 0x9, 0x4, 0x9, 0x20, 0x2, 0xa03, 0x0, 0x2, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r1 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r1, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:51 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r4, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r5, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r6 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:58:51 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) openat$cgroup_subtree(r2, &(0x7f0000000440), 0x2, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r4, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:58:51 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) r3 = socket$inet(0x2, 0x5, 0x20000000) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001780)) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:58:51 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl$HIDIOCGREPORT(r0, 0x400c4807, &(0x7f00000001c0)={0x1, 0x100, 0x3ff}) pipe(&(0x7f0000000340)) 18:58:52 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) pipe(&(0x7f0000000340)) 18:58:52 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r1 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r1, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:58:52 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) socket(0x3, 0x1, 0x3) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) [ 167.934920] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 167.936395] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 167.938375] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 167.941129] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 167.948043] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 167.950867] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 167.954911] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 167.957531] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 169.108094] Bluetooth: hci0: command 0x0c1a tx timeout [ 169.940514] Bluetooth: hci2: command 0x0c1a tx timeout [ 169.940582] Bluetooth: hci1: command 0x0c1a tx timeout [ 170.004103] Bluetooth: hci7: command 0x0c1a tx timeout [ 170.004125] Bluetooth: hci6: command 0x0c1a tx timeout [ 170.004189] Bluetooth: hci5: command 0x0c1a tx timeout [ 170.004618] Bluetooth: hci4: command 0x0c1a tx timeout [ 170.005880] Bluetooth: hci3: command 0x0c1a tx timeout 18:59:01 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) pipe2$9p(&(0x7f0000000400), 0x80000) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r3, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:01 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000b40)={'syztnl2\x00', &(0x7f0000000ac0)={'ip6_vti0\x00', r10, 0x4, 0xff, 0xff, 0x0, 0x34, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7, 0x7, 0x1000, 0x200}}) 18:59:01 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:01 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x1000) pipe(&(0x7f0000000340)) 18:59:01 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) socket$inet(0x2, 0x5, 0x20000000) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:01 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r4, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r5, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) r6 = socket(0x1, 0x6, 0x9) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:01 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x3f, 0x2, 0x90, 0x5, 0x0, 0x7fffffff, 0x1ad14, 0x9, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x400, 0x0, @perf_config_ext={0x8000, 0x400}, 0x100, 0x0, 0x5c1, 0x4, 0x321f, 0xff, 0x5, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:01 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x200000, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:01 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000140)) pipe(&(0x7f0000000340)) 18:59:01 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff) r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:01 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000300)={0xe0, 0x5, 0x0, "ecde0b68efd19a8c0f971cc6553e85d5f31b17b44ef2a1a4f5513e25e0a13397afac7f56b6130394b25ce02f3506ec00210140990e97cfb5ced05a0a303892a84d0f86eaf2e2f1b44170f3e24b01201ac1b669dc43f18f5062d168518e599606aec784e7e6830bcf91dd1267afcfb4660f83361a2bd68c1e9fe5500369878c1776afc340b70ac713d788f125a2871a1316756cf7cf6765e78532d5bb2a62b19e5a75e9f75b7c56b7f4def21f215fc413a28dd7d5cbf7a77515ad99d35a80ca4fe2934df97fb72e2b1c7cceef596cedec3f84e61f214e8ca40b66550ed3ee7e77"}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r3, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:01 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r4, 0x89f6, &(0x7f0000000680)={'sit0\x00', &(0x7f0000000600)={'syztnl1\x00', r5, 0x4, 0xec, 0x20, 0x1000, 0x71, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x8000, 0x2, 0x8000}}) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 177.750320] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 177.751550] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 177.752806] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 177.755391] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 177.756641] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 177.758615] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 177.759854] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 177.761562] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 178.964099] Bluetooth: hci0: command 0x0c1a tx timeout [ 179.796222] Bluetooth: hci7: command 0x0c1a tx timeout [ 179.797137] Bluetooth: hci6: command 0x0c1a tx timeout [ 179.797184] Bluetooth: hci5: command 0x0c1a tx timeout [ 179.797936] Bluetooth: hci4: command 0x0c1a tx timeout [ 179.798978] Bluetooth: hci3: command 0x0c1a tx timeout [ 179.799730] Bluetooth: hci2: command 0x0c1a tx timeout [ 179.800651] Bluetooth: hci1: command 0x0c1a tx timeout 18:59:11 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:11 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) pipe(&(0x7f00000002c0)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:11 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) syz_genetlink_get_family_id$mptcp(&(0x7f0000001680), r0) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:11 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r5, 0x89fb, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x2f, 0x0, 0x7e, 0x9, 0x1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8000, 0x4, 0x5}}) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:11 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000980), &(0x7f00000009c0)=0x14) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:11 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000040)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:11 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in, @in6=@ipv4={""/10, ""/2, @multicast1}}}, {{@in6=@mcast1}, 0x0, @in=@private}}, &(0x7f0000001880)=0xe8) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:11 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can={0x1d, 0x0}, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r2 = accept4(r1, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r2, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4(r3, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', r0, 0x4, 0x7, 0xe7, 0x9, 0x21, @remote, @mcast1, 0x1, 0x8000, 0x1ff, 0x8}}) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:11 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) pipe(&(0x7f0000000280)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:11 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000)='FROZEN\x00', 0x7) r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:11 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:11 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) pipe(&(0x7f0000000340)) [ 187.150140] kmemleak: Found object by alias at 0x607f1a63974c [ 187.150166] CPU: 0 UID: 0 PID: 4305 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 187.150184] Tainted: [W]=WARN [ 187.150188] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 187.150196] Call Trace: [ 187.150200] [ 187.150205] dump_stack_lvl+0xca/0x120 [ 187.150234] __lookup_object+0x94/0xb0 [ 187.150251] delete_object_full+0x27/0x70 [ 187.150268] free_percpu+0x30/0x1160 [ 187.150284] ? arch_uprobe_clear_state+0x16/0x140 [ 187.150305] futex_hash_free+0x38/0xc0 [ 187.150320] mmput+0x2d3/0x390 [ 187.150339] do_exit+0x79d/0x2970 [ 187.150357] ? __pfx_do_exit+0x10/0x10 [ 187.150371] ? find_held_lock+0x2b/0x80 [ 187.150389] ? get_signal+0x835/0x2340 [ 187.150409] do_group_exit+0xd3/0x2a0 [ 187.150424] get_signal+0x2315/0x2340 [ 187.150441] ? put_task_stack+0xd2/0x240 [ 187.150455] ? __pfx_get_signal+0x10/0x10 [ 187.150471] ? __schedule+0xe91/0x3590 [ 187.150491] arch_do_signal_or_restart+0x80/0x790 [ 187.150509] ? __pfx_arch_do_signal_or_restart+0x10/0x10 18:59:11 executing program 7: ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x3) r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 187.150529] ? __x64_sys_futex+0x1c9/0x4d0 [ 187.150542] ? __x64_sys_futex+0x1d2/0x4d0 [ 187.150557] ? __pfx___x64_sys_futex+0x10/0x10 [ 187.150569] ? selinux_file_ioctl+0xb9/0x280 [ 187.150590] exit_to_user_mode_loop+0x8b/0x110 [ 187.150603] do_syscall_64+0x2f7/0x360 [ 187.150615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.150627] RIP: 0033:0x7fe7093d8b19 [ 187.150636] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 187.150641] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 187.150653] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 187.150660] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 187.150667] RBP: 00007fe7094ebf60 R08: 0000000000000019 R09: 0000000000000000 [ 187.150675] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 187.150682] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 187.150698] [ 187.150701] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 187.150708] kmemleak: comm "syz-executor.3", pid 4303, jiffies 4294853897 [ 187.150715] kmemleak: min_count = 1 [ 187.150719] kmemleak: count = 0 [ 187.150723] kmemleak: flags = 0x21 [ 187.150726] kmemleak: checksum = 0 [ 187.150730] kmemleak: backtrace: [ 187.150734] pcpu_alloc_noprof+0x87a/0x1170 [ 187.150749] percpu_ref_init+0x37/0x400 [ 187.150766] io_uring_setup+0x44c/0x2000 [ 187.150778] __x64_sys_io_uring_setup+0xc8/0x170 [ 187.150788] do_syscall_64+0xbf/0x360 [ 187.150797] entry_SYSCALL_64_after_hwframe+0x77/0x7f 18:59:11 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='cubic\x00', 0x6) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:11 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f00000015c0)={'filter\x00', 0x0, 0x4, 0x9b, [0x7, 0x80000000, 0x3, 0x7f, 0x2, 0x8], 0x6, &(0x7f0000001480)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001500)=""/155}, &(0x7f0000001640)=0x78) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:11 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:11 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) pipe(&(0x7f0000000340)) 18:59:11 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:11 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) pipe(&(0x7f0000000200)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) [ 187.831172] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 187.832721] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 187.834407] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 187.835821] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 187.837993] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 187.839561] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 187.841331] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 187.842734] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 189.012093] Bluetooth: hci0: command 0x0c1a tx timeout [ 189.844159] Bluetooth: hci7: command 0x0c1a tx timeout [ 189.845271] Bluetooth: hci6: command 0x0c1a tx timeout [ 189.845323] Bluetooth: hci5: command 0x0c1a tx timeout [ 189.846273] Bluetooth: hci4: command 0x0c1a tx timeout [ 189.847163] Bluetooth: hci3: command 0x0c1a tx timeout [ 189.848089] Bluetooth: hci2: command 0x0c1a tx timeout [ 189.848857] Bluetooth: hci1: command 0x0c1a tx timeout 18:59:21 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:21 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) setsockopt$inet6_tcp_TLS_RX(r6, 0x6, 0x2, &(0x7f0000000940)=@gcm_256={{0x304}, "065e651dbe3d2f41", "162fab22e3d41f2c4d409283607784f7327b2362c7dd32b26511e22fc1d3725d", "accc475c", "74e2eaa14eea86e1"}, 0x38) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:21 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:21 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:21 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f00000001c0)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:21 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) pipe(&(0x7f0000000340)) 18:59:21 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:21 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept(r0, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:21 executing program 7: r0 = syz_io_uring_setup(0x0, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 197.154399] kmemleak: Found object by alias at 0x607f1a63974c [ 197.154424] CPU: 0 UID: 0 PID: 4364 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 197.154444] Tainted: [W]=WARN [ 197.154448] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 197.154459] Call Trace: [ 197.154463] [ 197.154468] dump_stack_lvl+0xca/0x120 [ 197.154496] __lookup_object+0x94/0xb0 [ 197.154516] delete_object_full+0x27/0x70 [ 197.154535] free_percpu+0x30/0x1160 [ 197.154552] ? arch_uprobe_clear_state+0x16/0x140 [ 197.154572] futex_hash_free+0x38/0xc0 [ 197.154588] mmput+0x2d3/0x390 [ 197.154607] do_exit+0x79d/0x2970 [ 197.154625] ? __pfx_do_exit+0x10/0x10 [ 197.154639] ? find_held_lock+0x2b/0x80 [ 197.154657] ? get_signal+0x835/0x2340 [ 197.154677] do_group_exit+0xd3/0x2a0 [ 197.154692] get_signal+0x2315/0x2340 [ 197.154710] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 197.154727] ? __pfx_get_signal+0x10/0x10 [ 197.154743] ? __schedule+0xe91/0x3590 [ 197.154764] arch_do_signal_or_restart+0x80/0x790 [ 197.154789] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 197.154805] ? __x64_sys_futex+0x1c9/0x4d0 [ 197.154817] ? __x64_sys_futex+0x1d2/0x4d0 [ 197.154833] ? __pfx___x64_sys_futex+0x10/0x10 [ 197.154845] ? selinux_file_ioctl+0xb9/0x280 [ 197.154866] exit_to_user_mode_loop+0x8b/0x110 [ 197.154879] do_syscall_64+0x2f7/0x360 [ 197.154892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.154904] RIP: 0033:0x7fe7093d8b19 [ 197.154914] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 197.154919] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 197.154931] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 197.154938] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 197.154946] RBP: 00007fe7094ebf60 R08: 0000000000000019 R09: 0000000000000000 [ 197.154953] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 197.154961] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 197.154977] [ 197.154981] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 197.154988] kmemleak: comm "syz-executor.3", pid 4367, jiffies 4294863943 [ 197.154995] kmemleak: min_count = 1 [ 197.154999] kmemleak: count = 0 [ 197.155003] kmemleak: flags = 0x21 [ 197.155007] kmemleak: checksum = 0 [ 197.155011] kmemleak: backtrace: [ 197.155015] pcpu_alloc_noprof+0x87a/0x1170 [ 197.155029] percpu_ref_init+0x37/0x400 [ 197.155047] io_uring_setup+0x44c/0x2000 [ 197.155059] __x64_sys_io_uring_setup+0xc8/0x170 [ 197.155070] do_syscall_64+0xbf/0x360 [ 197.155079] entry_SYSCALL_64_after_hwframe+0x77/0x7f 18:59:21 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001440), 0x4) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:21 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$HIDIOCINITREPORT(r1, 0x4805, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:21 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 197.343641] kmemleak: Found object by alias at 0x607f1a63974c [ 197.343665] CPU: 0 UID: 0 PID: 4377 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 197.343684] Tainted: [W]=WARN [ 197.343688] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 197.343696] Call Trace: [ 197.343700] [ 197.343704] dump_stack_lvl+0xca/0x120 [ 197.343732] __lookup_object+0x94/0xb0 [ 197.343749] delete_object_full+0x27/0x70 [ 197.343765] free_percpu+0x30/0x1160 [ 197.343781] ? arch_uprobe_clear_state+0x16/0x140 [ 197.343801] futex_hash_free+0x38/0xc0 [ 197.343815] mmput+0x2d3/0x390 [ 197.343833] do_exit+0x79d/0x2970 [ 197.343846] ? signal_wake_up_state+0x85/0x120 [ 197.343862] ? zap_other_threads+0x2b9/0x3a0 [ 197.343878] ? __pfx_do_exit+0x10/0x10 [ 197.343890] ? do_group_exit+0x1c3/0x2a0 [ 197.343903] ? lock_release+0xc8/0x290 [ 197.343920] do_group_exit+0xd3/0x2a0 [ 197.343938] __x64_sys_exit_group+0x3e/0x50 [ 197.343952] x64_sys_call+0x18c5/0x18d0 [ 197.343967] do_syscall_64+0xbf/0x360 [ 197.343979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.343990] RIP: 0033:0x7fe7093d8b19 18:59:21 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) [ 197.343999] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 197.344004] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 197.344015] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 197.344023] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 197.344031] RBP: 0000000000000000 R08: 0000001b2d122514 R09: 0000000000000000 [ 197.344038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.344045] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 197.344061] [ 197.344064] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 197.344071] kmemleak: comm "syz-executor.3", pid 4367, jiffies 4294863943 [ 197.344078] kmemleak: min_count = 1 [ 197.344082] kmemleak: count = 0 [ 197.344085] kmemleak: flags = 0x21 [ 197.344089] kmemleak: checksum = 0 [ 197.344093] kmemleak: backtrace: [ 197.344096] pcpu_alloc_noprof+0x87a/0x1170 [ 197.344111] percpu_ref_init+0x37/0x400 [ 197.344128] io_uring_setup+0x44c/0x2000 [ 197.344140] __x64_sys_io_uring_setup+0xc8/0x170 [ 197.344151] do_syscall_64+0xbf/0x360 [ 197.344159] entry_SYSCALL_64_after_hwframe+0x77/0x7f 18:59:21 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x2f, 0x40, 0x1, 0x7, 0x14, @empty, @local, 0x8, 0x8, 0xb98, 0x8}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) [ 197.801330] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 197.802167] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 197.802887] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 197.804526] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 197.805332] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 197.806043] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 197.807317] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 197.808432] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 198.996055] Bluetooth: hci0: command 0x0c1a tx timeout [ 199.828127] Bluetooth: hci7: command 0x0c1a tx timeout [ 199.828683] Bluetooth: hci6: command 0x0c1a tx timeout [ 199.829202] Bluetooth: hci5: command 0x0c1a tx timeout [ 199.829667] Bluetooth: hci4: command 0x0c1a tx timeout [ 199.830185] Bluetooth: hci3: command 0x0c1a tx timeout [ 199.830379] Bluetooth: hci2: command 0x0c1a tx timeout [ 199.830649] Bluetooth: hci1: command 0x0c1a tx timeout 18:59:30 executing program 7: r0 = syz_io_uring_setup(0x0, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:30 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:30 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:30 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r9) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:30 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) socket$inet6_tcp(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:30 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:30 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x80, 0x1, 0x0, 0x7, 0x0, 0x3ff, 0x82102, 0xa, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x2220, 0x0, 0xca, 0x9, 0x1f, 0x400, 0x3, 0x0, 0x81, 0x0, 0xa7b}, r0, 0x4, r0, 0x5) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:30 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:30 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r0, 0x5, 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:30 executing program 6: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:30 executing program 7: r0 = syz_io_uring_setup(0x0, &(0x7f00000004c0)={0x0, 0xb8f9, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 206.359737] kmemleak: Found object by alias at 0x607f1a63974c [ 206.359761] CPU: 0 UID: 0 PID: 4417 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 206.359780] Tainted: [W]=WARN [ 206.359784] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 206.359791] Call Trace: [ 206.359795] [ 206.359800] dump_stack_lvl+0xca/0x120 [ 206.359827] __lookup_object+0x94/0xb0 [ 206.359845] delete_object_full+0x27/0x70 [ 206.359861] free_percpu+0x30/0x1160 [ 206.359877] ? arch_uprobe_clear_state+0x16/0x140 [ 206.359897] futex_hash_free+0x38/0xc0 [ 206.359912] mmput+0x2d3/0x390 [ 206.359930] do_exit+0x79d/0x2970 [ 206.359944] ? signal_wake_up_state+0x85/0x120 [ 206.359959] ? zap_other_threads+0x2b9/0x3a0 [ 206.359975] ? __pfx_do_exit+0x10/0x10 [ 206.359987] ? do_group_exit+0x1c3/0x2a0 [ 206.360005] ? lock_release+0xc8/0x290 [ 206.360022] do_group_exit+0xd3/0x2a0 [ 206.360036] __x64_sys_exit_group+0x3e/0x50 [ 206.360050] x64_sys_call+0x18c5/0x18d0 [ 206.360065] do_syscall_64+0xbf/0x360 [ 206.360077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.360089] RIP: 0033:0x7fe7093d8b19 [ 206.360098] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 206.360103] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 206.360114] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 206.360122] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 206.360129] RBP: 0000000000000000 R08: 0000001b2d120ca4 R09: 0000000000000000 [ 206.360136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.360143] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 206.360159] [ 206.360162] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 206.360169] kmemleak: comm "syz-executor.3", pid 4428, jiffies 4294873144 [ 206.360176] kmemleak: min_count = 1 [ 206.360180] kmemleak: count = 0 [ 206.360183] kmemleak: flags = 0x21 [ 206.360187] kmemleak: checksum = 0 [ 206.360191] kmemleak: backtrace: [ 206.360194] pcpu_alloc_noprof+0x87a/0x1170 [ 206.360209] percpu_ref_init+0x37/0x400 [ 206.360226] io_uring_setup+0x44c/0x2000 [ 206.360237] __x64_sys_io_uring_setup+0xc8/0x170 [ 206.360248] do_syscall_64+0xbf/0x360 [ 206.360257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.054751] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 207.055631] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 207.056536] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 207.057302] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 207.058289] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 207.062607] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 207.063421] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 207.064327] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 208.276112] Bluetooth: hci0: command 0x0c1a tx timeout [ 209.109797] Bluetooth: hci7: command 0x0c1a tx timeout [ 209.109825] Bluetooth: hci6: command 0x0c1a tx timeout [ 209.109865] Bluetooth: hci5: command 0x0c1a tx timeout [ 209.110953] Bluetooth: hci4: command 0x0c1a tx timeout [ 209.111425] Bluetooth: hci3: command 0x0c1a tx timeout [ 209.112314] Bluetooth: hci2: command 0x0c1a tx timeout [ 209.112735] Bluetooth: hci1: command 0x0c1a tx timeout 18:59:41 executing program 6: pipe(&(0x7f0000000000)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:41 executing program 2: openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:41 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:41 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) accept(r0, &(0x7f00000007c0)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000840)=0x80) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:41 executing program 7: r0 = syz_io_uring_setup(0x56b9, 0x0, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:41 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 18:59:41 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000001400)) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:41 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:41 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:41 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0xd1}, 0x2000c854) r2 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:41 executing program 6: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:41 executing program 7: r0 = syz_io_uring_setup(0x56b9, 0x0, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 217.127210] kmemleak: Found object by alias at 0x607f1a63974c [ 217.127242] CPU: 0 UID: 0 PID: 4463 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 217.127275] Tainted: [W]=WARN [ 217.127288] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 217.127300] Call Trace: [ 217.127306] [ 217.127314] dump_stack_lvl+0xca/0x120 [ 217.127356] __lookup_object+0x94/0xb0 [ 217.127386] delete_object_full+0x27/0x70 [ 217.127415] free_percpu+0x30/0x1160 [ 217.127443] ? arch_uprobe_clear_state+0x16/0x140 [ 217.127478] futex_hash_free+0x38/0xc0 [ 217.127503] mmput+0x2d3/0x390 [ 217.127536] do_exit+0x79d/0x2970 [ 217.127560] ? signal_wake_up_state+0x85/0x120 [ 217.127588] ? zap_other_threads+0x2b9/0x3a0 [ 217.127617] ? __pfx_do_exit+0x10/0x10 [ 217.127639] ? do_group_exit+0x1c3/0x2a0 [ 217.127664] ? lock_release+0xc8/0x290 [ 217.127694] do_group_exit+0xd3/0x2a0 [ 217.127721] __x64_sys_exit_group+0x3e/0x50 [ 217.127746] x64_sys_call+0x18c5/0x18d0 [ 217.127772] do_syscall_64+0xbf/0x360 [ 217.127793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.127814] RIP: 0033:0x7fe7093d8b19 [ 217.127830] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 217.127839] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 217.127859] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 217.127873] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 217.127886] RBP: 0000000000000000 R08: 0000001b2d1209b8 R09: 0000000000000000 [ 217.127898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.127911] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 217.127939] [ 217.127946] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 217.127958] kmemleak: comm "syz-executor.3", pid 4462, jiffies 4294883778 [ 217.127970] kmemleak: min_count = 1 [ 217.127977] kmemleak: count = 0 [ 217.127984] kmemleak: flags = 0x21 [ 217.127991] kmemleak: checksum = 0 [ 217.127997] kmemleak: backtrace: [ 217.128003] pcpu_alloc_noprof+0x87a/0x1170 [ 217.128030] percpu_ref_init+0x37/0x400 [ 217.128061] io_uring_setup+0x44c/0x2000 [ 217.128081] __x64_sys_io_uring_setup+0xc8/0x170 [ 217.128101] do_syscall_64+0xbf/0x360 [ 217.128116] entry_SYSCALL_64_after_hwframe+0x77/0x7f 18:59:41 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) r1 = socket(0x8, 0x6, 0x5) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000001380)="3e218afd6077f1051bab6ccaf37910d6bc51487f7a604b87a28dc97672ced84ecf2f6f11bc4804657cd62ba84996812c0a7103f4971f9d9d79a44f0dca888da8aba50b7e8e647646e439c51b651bfd", 0x4f) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:41 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = accept4(r5, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r7, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x18, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9d}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:41 executing program 7: r0 = syz_io_uring_setup(0x56b9, 0x0, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:41 executing program 2: r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:41 executing program 6: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:41 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x81, 0x1, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x10, 0x5, 0x6f}}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 217.688981] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 217.690336] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 217.691627] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 217.694486] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 217.695956] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 217.698086] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 217.700431] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 217.702176] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 218.900090] Bluetooth: hci0: command 0x0c1a tx timeout [ 219.733377] Bluetooth: hci7: command 0x0c1a tx timeout [ 219.733435] Bluetooth: hci6: command 0x0c1a tx timeout [ 219.734723] Bluetooth: hci5: command 0x0c1a tx timeout [ 219.735266] Bluetooth: hci4: command 0x0c1a tx timeout [ 219.735886] Bluetooth: hci3: command 0x0c1a tx timeout [ 219.736609] Bluetooth: hci2: command 0x0c1a tx timeout [ 219.738218] Bluetooth: hci1: command 0x0c1a tx timeout 18:59:50 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 18:59:50 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:50 executing program 6: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:50 executing program 2: r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:50 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) pipe2$9p(&(0x7f0000000280), 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:50 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) socket(0x8, 0x6, 0x5) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 18:59:50 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f00000002c0)={0x14aa00000000000, 0x5}) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 18:59:50 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept4(r4, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r2, 0x2f, 0x3f, 0x0, 0x9, 0x12, @mcast1, @local, 0x8, 0x700, 0x2, 0x8001}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:50 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 18:59:50 executing program 2: r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 18:59:50 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x304}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:50 executing program 6: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) pipe(&(0x7f0000000340)) 18:59:50 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001340)=[{&(0x7f0000001140)=""/122, 0x7a}, {&(0x7f00000011c0)=""/176, 0xb0}, {&(0x7f0000001280)=""/130, 0x82}], 0x3) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) [ 226.370735] kmemleak: Found object by alias at 0x607f1a63974c [ 226.370767] CPU: 0 UID: 0 PID: 4523 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 226.370799] Tainted: [W]=WARN [ 226.370806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 226.370819] Call Trace: [ 226.370826] [ 226.370833] dump_stack_lvl+0xca/0x120 [ 226.370875] __lookup_object+0x94/0xb0 [ 226.370904] delete_object_full+0x27/0x70 [ 226.370933] free_percpu+0x30/0x1160 [ 226.370961] ? arch_uprobe_clear_state+0x16/0x140 [ 226.371003] futex_hash_free+0x38/0xc0 [ 226.371030] mmput+0x2d3/0x390 [ 226.371063] do_exit+0x79d/0x2970 [ 226.371087] ? signal_wake_up_state+0x85/0x120 [ 226.371115] ? zap_other_threads+0x2b9/0x3a0 [ 226.371144] ? __pfx_do_exit+0x10/0x10 [ 226.371167] ? do_group_exit+0x1c3/0x2a0 [ 226.371191] ? lock_release+0xc8/0x290 [ 226.371221] do_group_exit+0xd3/0x2a0 [ 226.371247] __x64_sys_exit_group+0x3e/0x50 [ 226.371273] x64_sys_call+0x18c5/0x18d0 [ 226.371299] do_syscall_64+0xbf/0x360 [ 226.371320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.371341] RIP: 0033:0x7fe7093d8b19 [ 226.371356] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 226.371365] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 226.371386] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 226.371400] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 18:59:50 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r2, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept4(r3, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) syz_genetlink_get_family_id$mptcp(&(0x7f0000000480), r0) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 18:59:50 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 226.371413] RBP: 0000000000000000 R08: 0000001b2d120458 R09: 0000000000000000 [ 226.371425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 226.371437] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 226.371466] [ 226.371473] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 226.371485] kmemleak: comm "syz-executor.3", pid 4520, jiffies 4294892951 [ 226.371497] kmemleak: min_count = 1 [ 226.371504] kmemleak: count = 0 [ 226.371511] kmemleak: flags = 0x21 [ 226.371518] kmemleak: checksum = 0 [ 226.371525] kmemleak: backtrace: [ 226.371531] pcpu_alloc_noprof+0x87a/0x1170 [ 226.371557] percpu_ref_init+0x37/0x400 [ 226.371589] io_uring_setup+0x44c/0x2000 [ 226.371609] __x64_sys_io_uring_setup+0xc8/0x170 [ 226.371629] do_syscall_64+0xbf/0x360 [ 226.371644] entry_SYSCALL_64_after_hwframe+0x77/0x7f 18:59:50 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 18:59:51 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 18:59:51 executing program 6: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(0x0) [ 226.860413] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 226.861553] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 226.863266] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 226.864739] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 226.866555] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 226.867662] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 226.869588] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 226.870705] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 228.054088] Bluetooth: hci0: command 0x0c1a tx timeout [ 228.884145] Bluetooth: hci7: command 0x0c1a tx timeout [ 228.884202] Bluetooth: hci6: command 0x0c1a tx timeout [ 228.885203] Bluetooth: hci5: command 0x0c1a tx timeout [ 228.885681] Bluetooth: hci4: command 0x0c1a tx timeout [ 228.886671] Bluetooth: hci3: command 0x0c1a tx timeout [ 228.887104] Bluetooth: hci2: command 0x0c1a tx timeout [ 228.888485] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:01 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) accept4$inet(r1, 0x0, &(0x7f0000000240), 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = accept4(r2, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:01 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001100)=@buf={0x1000, &(0x7f0000000100)="2b5aae6f71a98b335745ab489df8ac339b89785d9beb75ae6abaaa2da61069d4747a9e3a3e2f3d90e76255b9ee2d132a76f4c19bcc9988a92d84ac8462c2b96686f23ed69f9bed20a076a34aa3cef9a094cd151d95dbaecdd3b29d11d62be37c17a27e38223e96974be2f95526907185953d566468923ca9db7cb242520834a51d7cf0f12690ee489700ca3de6138a6101de308352ea25d7df3c1ba9c4ef8105a433bb14d3c872e5cb5f5f122c07957eb0d3493e2917dc234794b38aa1e211d2942d327395af03d54067929686b51c050d02fffd100b5d285a562fe9502afc785d5b2a5f681798841335b8e1e1ebc4dd81f2b0d1d704a559e5304aa6fbc8e618ef3f1fa4f7c3ced07e1262cf7c3ffef021211307aacbc37ac80571f91da548261907e0a13309b646eca3be00675ec79ea4724015a06d819014df1018be46dcd6875e4966fae33305e325323d87ae619c7b7dba47a90d3d69c56f958ccbe9f148d902eb8c6753631c76a8cd9dc0b9e2f20291a4490763c1a0ccbbb0b293e896df5ff833c8e3ad3ef621784ac036f1c729f8f9abd2b3d1ab0e1e463203eb73760cdbb7a51f0bd48afff330f67203b406825d8072e79972b0b52d1196dbd068e6c9bfe6667e800389444e0132b70c4dc95a32b0cbe07312b9a3f1581e2c243151a1674eaede8e7ca5b844563ada8a9079508777bc945fc2ef9338a63f29a5e7f2f1ccb2b5fc0a2cde95ba819b8b01845e25fb5fa08e9646a0e251e2e14cbf637b897eeba0215248e2f07b982714f0eaf61c9df02bb81b6e64a04838a0264e7d6719f4d8e63f198617cdb09614bb9fa2939f143fa9ca9f26b294f5df5f5e109b898cf729ec2cf1354094ae71b83385781c8dd1525f8777dc02ced721d673ad298e576da1cbe37845f3a90221749fe0a7130dd32193ff626b566c7bcefcac83ef584d1c37d04a6ea1f14b84c291d5d1e5140bdaf1d43afbb9a25db19042cc9de7311d25dbb89526300afc982666bc6c41ed7b06164bcf11bdad64c0014385bf40f2e6d622a1f171625a50a3bc950440af92528098d201c9b35485f460ffffca0c951d84428c905cd1a7baf398b86c313a65a2c515f0de13e74f262a6e0c3d6e1357f3532ed2353d9a1ce049e3796702dc69888c7de8b12daf713c46aa81783fec635378c85094d0b4f278d6011a8111125be90ca4aabe43bedffdfdfb3d108386bb82df33e3a08d6ef631a658aedb9d0f8caaad0a3197f7b5b00999206ad5d8cd9e3694b1f492912d23ee7195213ed274c732c9aeb66b50fad50889123a32e6bc7e9a6b1c878de295713a91ad0c835be48cd4cad67f7a57ab0ab6ba1a4f5cbfc32ded0dc67e3b8e5fd618067e2e02867fda33aeca24c0f8e7d0d7b749d8faa502204d7339de2e7c50b4cedd0bc27976866aebe081f555c21c707996d5bf8178b6bb6e0925b8ded654b248b6ebd203b3d18ef29df72a26020d87d5cc8a7389d4170425892b9471e19d2b9e275c25188a376d8aa31e0e4648f63d0e3867109d99537ed1d73a5c772ed267b59281850c08b83deacb355caf57c0482b1e152bbf690303279bc1a0b4ea22549a7f99863e94e2acb7e180c17ae72d50471488a56e3f18980a964d2b84e0d9a52ca1c1345bc0cfea3c27c06a0f00f6ce6c2612bc6fbc398ebc0ab0edcff168c7859f9dcedad5795c93d914e627b4952a6719f00b1c1fe57183feb70271af983fb927734dd4d4dc50ff3f6c4ef618902dad39ddf2db2c14d747d57aad9d05ec91d3f92ce9b9a2b810f46e0639409ad3bd2f9dd9b74569cfd38623b0cc64f6b467f53c27ab91668cc2965fde60b49778b164d9f8b86feae5eeb3ce568c50560d0a1ffb3346dfcac2920b3bd4fba62f8e02ec9f6ae1e5597d1e44ad451080a8a347e1cace6c504c2ba6fe6aa93c262a82585c16928050189ed5c12d58c5b981fe7a3bc3d7825cfacea6c93d8c9fb49b39497e088bd6f451ecd5ffe5b4b5ff14040e9a2b8defa74ba8a124887eff58345116ecd6233974472323620477543bc4f36ea46d4194cd8217229a60b56e318ed165c580dcad516091fb3bc6bdb57496abc7d1bfc8cca92cac901e8d304ffa2660a1d9d9924826a17212e4b133ffe0233b7e9e435b1bc450f346a1f58be6fe97dbf51ae6335fcf7521537b10f6941bd60b0d4fdda95d132af5a39e5ca32a240f006b220f8b836a54947acf5ddd1aee136e90b8e207fa3eefc5199d7ef316853827e4c269d32dece2eb0f06451a0377f7e45ddff762e4586bc368fec6a29ad39c191ddeb78a4fe407089ab0242387127addcb0e48e8953421a69172b9577ec8c608d447c637605673fff32ff5d2fe8151c6d770db2ea4602bbf76791ef4fbfef5521347013b2a89fbc97a785fe4f52d2b9b07a86d5c2f422c850dee986027abfb0c1e8cba9800fdd1863fbe5b01695954e36ce45e071a42330c48ddbb88379da2e7f3db5964360bc1c5b6266cb9b42fd4cb8c439a0eee09f58caf39a41c43ffd6f2a8a5b1ffcbd7fedeb05151e35bd8665e6194b7b40d3448d1b42c90f71d48b100722740e8c67cf89b78a1565f14dabc4fb992955d605846a494ba3cabd4327f411cca95d5e32652c70cee172b901c72cafbddee528ccfa5f2e07e0c7e5b9d4bb413fbb8afa84d283f498cae93079187040e5905621bb671c99ff98e85d81f8a2c41a40600588019105a5fc845a8d4d5d127cf7a0d162b19060a2f04f0792d0f53b377dabd13fdde490323be2e74a4a13d33dd156e8c77b4a2c8e5229c0b20af84f81e3aeeac48e002463b475d19a8aa7648e1643cf4fbcb774f7d4afbb505939d62757035fb6c2e090b2e9271874ba2b0811e68480c81b462e93fa46b12e881eab86366d482352c18eeb3b1f95708f2449615e745cd4def20781106c014e9a9cc23e27065066ec6440d7ae9466bb4f478d132ef0c91f22888ba06d1a55a3b3a5e299325de8302cb588946ee3b8bf76efee05f25b199331a99680279fe2a27f767e4e1114d2102f1f86ef174a19a31a95903f0a415c2d343ccdea630d8b71792f2261ee489cd6f4beb99fcd7a874ec8d1be424ac013e484532add853decbe1fcba9390a3a8f9f917290c4f49076870126d32aad9bf167fc14748cac6590111bdbe1beb67655393804f52ed09a9ae85fd7a924007d022cdef72740092c526e0b07ebd0e18c59368fabfa74450487c06cc6b0d3ea31495272ba5832a228d6f7d9eb5f7835a92d1074b2fdb49249a983e84899325bf9616afba3a078714d8a4521410d151aee7429ed32fded412701a69cd16b182e98ba73a7a0e22c80221e40d9be7532a96261753b7dfae26bf86d52e07c6a2c4a113e7788e7a922e62313b61ea16a4915ff1899711caeabae6d4d6908658fb9c961f826ad4a525fee892e94b321b8043d96a92ba6ebb6d350544b373664b85bc7b44e21314e0a5d6a7acdbf32da9e579f98f28910f5220c504e4fb3dabf79881e330789fecf8a719cea5a5b3252568eb59820d3ebe0ad3f65dceea8916cc18214d831cc45d1f49e172e1c939b13f1f99405f503cde4ad23d453b9afbb1d84d371b2ff1ad6f05efac34ca768c5a7fe2e8fbb71273712fc94258973111bad1930df1e60a86a91314fde52fbb48c27ca7cd136bdef7b201754ee42e804ec85cf2358ea3e30e1622ad29cfc875ad062f8b22b7e4f8d644863db4398a6d86be1c05bb73a2a7cbb6a11f5391d16f5719bf290998244914917d2e4427b9392ea5812c8bd62d3e79b88adcf07bfbbe805da93b6b019d8d48afe11f0e445446ddc4034d6f4f6b5dbb4228c13fda6080edd290dfab9bff46ad6c9d26931133a449f20d090b2b93c2422a77549ac32f0bf2a490d9a9cf043269975ae91bba68d64e0d28160d011b55500a9db103cf14e57c7b3deafcaa1af268b0f61b218ae6cd57549663cb9a7fa7956e8b22251c111d96b64468f0e0152809d67b5439b39c3a88fa8d29bca71136d3bab9fa909b5aa9eed0d5bcfb7244798ad6fc001da794b5b9c354bdae9d3639ce69270108140a0e31cd856b0afb220cddcebe66fe714ccf4118146d2f364d0c247bc7b06041a9070b3cb6a0604e45aaf3fa91ea43ee2910f3e1ace4e99fafd4044e9904421ccb0c4e3e77d2db7319cb12a8975fef6095648b960e2c24f7a9d70757d1aa22302962e1c5172de49567bf149bf04f81c6b08e87b4745480be8278d427ffcb89c54c948e60969e69fcb42ad40d14323a6e9abf914ba02c70c9516f070ebc59d2ada4b4086a8d6cf07894d5c40b78d2b74882884cc801f966418c2e074856cdc3cd65dafa013a105d5bc311b7e78f512709174fc88e4ec64c2158b415017d9522de59505fae6378833fb550f5de8eb0575e86e3bfbbe8f60a7e8f09d7a91fde73fe70cd66f8e2eefe0eee7218183b644743ae06c0091bbd8739eccf7be2bd6a9bc8e8d829c0fbfc69e649c17d53450909f872bac1dcd0c3924658cc53060f8fd072a972d270887af8557ea78606c4e8e8719d1ad4ab31ad617e5627e23456c02fb7d6426bbb2130e309ef801b8e9485e4ac9daf21fecbd3a1863d3375b6ba44e0523508a847de7deda5089709515543f242ff7a3a0f8d2275963b2de35fe905ad362d1a1d3b860b2e0d569a1ee92ecb9e27f482780cb7fdbc5bd54f18eccdb8ad17c8705adca8ac9565883a9aa46feadef671afcc080a453bf01e053b2f3c291556150af35967f7955054c14c70eb994f8bb5a75e88c470799e94055a938f927f6c43035ffca5e5a12571f7bacec540685accc722fd5cae897db684e0a43b6181596145bc05720b9e9c62f6a5f737f71e380370d2b6eab8a47a1d1c7c364ed5a563a1618a9799cc36d6c0e3a250072c3664276335272d37182e8f4c10ad08ccfcf380cfe75a163ba8838a34f5a09b55327b87175b7f285167301513fce33ef4c68db3a8ecd79e2b21e630302e07a1fd320a6229e9542bc71d9c790ce5a3569860be4e4db9b1e268958e624dd67abed966429ab8b02c68ab03d8e45ef1ef9350fbc78ad547903a9c93241aeaeb093c4e7e5ea65024cf30296b18dd5d619a70f8b02b8bff0f63a77342ef1bf21350617798af16a7559386d8c0e7c05bcf08c9bd47f33fbe11ebf5b5e80d745811d36546da02f48fcc61f60c272e537840109b890dce34c6c85c0db9094c8f6d6b70f5626a98a829d40bcbbe2df65178f8238c5ad57788631f362f6df759ca12fb0ae6a5332c47611c738ea34ac5e0978dc12e7b2ba6328e5b17152b4606a0a7644c115010abfa40d802189d7595530617b30a361d1b53b1d8577c9137b0f1926741ec47ec39487585bd9b30717ab384373d967170dc7c359a72ce241c9c43ff12aa8b3f09fed823f8ea5e43e6ecb644822d3bed903c850574d25d4bb5f25800ec867477fd9877abd41263db22d05790a0a54d1da1b4664e97034d1dce73afe7afb7dd623bafa6c60f9d851c097d1dfe52fd560eadc6c934e3dc9fb5e51781de44fdd467e53b75b8cac9e9b110be5d8d45de8b135da3724f6c740d8b71af68ee1daffa7a807e7e01cfd3a149aa2852ca9ca89a0bb980a29c833c02610f81b79de8e3bcdbe68b1ee7ebe3a6a90c8b5f25a58a9c6612762fa75dc2582fc8bcbd9a66520297d5f76d548bb8c69fa9fc8a814ba0ad92a971f1b7464a0eb63ad88bf8fd4faa286e218b2668c30f200c54cd6ec9b51692ab8e9bd30c1e89d107315d55d53e6accd6983fb15cc7a9e753abe854ad1a7688338acdc07d0f2607c77121abe41d826e68"}) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 19:00:01 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:01 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:01 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r2, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept4(r3, &(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000400)=0x80, 0x800) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:01 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:01 executing program 6: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(0x0) 19:00:01 executing program 2: openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 19:00:01 executing program 2: openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 19:00:01 executing program 6: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) pipe(0x0) 19:00:01 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:01 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) accept4(r0, 0x0, &(0x7f0000000200), 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4(r1, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:01 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 19:00:01 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r2, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:01 executing program 2: openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, &(0x7f0000000580)={0x3, 0x0, [0x0, 0x0, 0x0]}) 19:00:01 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:00:01 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 237.672156] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 237.673324] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 237.674719] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 237.678476] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 237.682970] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 237.684919] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 237.686802] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 237.687921] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 238.868175] Bluetooth: hci0: command 0x0c1a tx timeout [ 239.700157] Bluetooth: hci7: command 0x0c1a tx timeout [ 239.700209] Bluetooth: hci6: command 0x0c1a tx timeout [ 239.701458] Bluetooth: hci5: command 0x0c1a tx timeout [ 239.702089] Bluetooth: hci4: command 0x0c1a tx timeout [ 239.703195] Bluetooth: hci3: command 0x0c1a tx timeout [ 239.703769] Bluetooth: hci2: command 0x0c1a tx timeout [ 239.704886] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:10 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) ioctl$HIDIOCSREPORT(r3, 0x400c4808, &(0x7f0000000240)={0x1, 0xffffffff, 0x6}) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:10 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r2, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f00000002c0)={'syztnl2\x00', r1, 0x2f, 0x6a, 0x96, 0x5, 0x40, @ipv4={'\x00', '\xff\xff', @empty}, @remote, 0x100, 0x7, 0x8, 0x8}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:10 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:10 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:00:10 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) accept(0xffffffffffffffff, 0x0, &(0x7f0000000040)) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 19:00:10 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:10 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, 0x0) 19:00:10 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:10 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:10 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:10 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), 0x0) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:10 executing program 4: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 19:00:10 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) socket$inet6_udp(0xa, 0x2, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:10 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 246.880106] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 246.881563] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 246.884342] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 246.886547] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 246.888987] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 246.891598] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 246.901669] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 246.903762] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 248.084096] Bluetooth: hci0: command 0x0c1a tx timeout [ 248.916199] Bluetooth: hci7: command 0x0c1a tx timeout [ 248.917291] Bluetooth: hci6: command 0x0c1a tx timeout [ 248.918314] Bluetooth: hci5: command 0x0c1a tx timeout [ 248.919299] Bluetooth: hci4: command 0x0c1a tx timeout [ 248.919606] Bluetooth: hci3: command 0x0c1a tx timeout [ 248.920295] Bluetooth: hci2: command 0x0c1a tx timeout [ 248.921110] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:21 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) accept4$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:21 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:21 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:21 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:00:21 executing program 4: openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x8180, 0x0) 19:00:21 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), 0x0) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:21 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:21 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), 0x0) io_uring_enter(r0, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:21 executing program 4: openat$zero(0xffffffffffffff9c, 0x0, 0x8180, 0x0) 19:00:21 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:21 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r1, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000, &(0x7f0000000200)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xfffffffffffffffb}}, {@aname={'aname', 0x3d, '.u^\'-{'}}], [{@euid_gt={'euid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}]}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:21 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:21 executing program 4: openat$zero(0xffffffffffffff9c, 0x0, 0x8180, 0x0) 19:00:21 executing program 7: syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 256.814455] kmemleak: Found object by alias at 0x607f1a63974c [ 256.814489] CPU: 0 UID: 0 PID: 4685 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 256.814522] Tainted: [W]=WARN [ 256.814529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 256.814541] Call Trace: [ 256.814548] [ 256.814556] dump_stack_lvl+0xca/0x120 [ 256.814599] __lookup_object+0x94/0xb0 [ 256.814628] delete_object_full+0x27/0x70 [ 256.814657] free_percpu+0x30/0x1160 [ 256.814685] ? arch_uprobe_clear_state+0x16/0x140 [ 256.814720] futex_hash_free+0x38/0xc0 [ 256.814745] mmput+0x2d3/0x390 [ 256.814778] do_exit+0x79d/0x2970 [ 256.814802] ? signal_wake_up_state+0x85/0x120 [ 256.814830] ? zap_other_threads+0x2b9/0x3a0 [ 256.814859] ? __pfx_do_exit+0x10/0x10 [ 256.814881] ? do_group_exit+0x1c3/0x2a0 [ 256.814906] ? lock_release+0xc8/0x290 [ 256.814936] do_group_exit+0xd3/0x2a0 [ 256.814970] __x64_sys_exit_group+0x3e/0x50 [ 256.814995] x64_sys_call+0x18c5/0x18d0 [ 256.815022] do_syscall_64+0xbf/0x360 [ 256.815043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.815063] RIP: 0033:0x7fe7093d8b19 [ 256.815079] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 256.815088] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 256.815109] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 256.815123] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 256.815136] RBP: 0000000000000000 R08: 0000001b2d126268 R09: 0000000000000000 [ 256.815148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 256.815160] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 256.815189] [ 256.815196] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 256.815208] kmemleak: comm "syz-executor.6", pid 4676, jiffies 4294923422 [ 256.815221] kmemleak: min_count = 1 [ 256.815227] kmemleak: count = 0 [ 256.815234] kmemleak: flags = 0x21 [ 256.815241] kmemleak: checksum = 0 [ 256.815248] kmemleak: backtrace: [ 256.815254] pcpu_alloc_noprof+0x87a/0x1170 [ 256.815280] percpu_ref_init+0x37/0x400 [ 256.815312] io_uring_setup+0x44c/0x2000 [ 256.815331] __x64_sys_io_uring_setup+0xc8/0x170 [ 256.815351] do_syscall_64+0xbf/0x360 [ 256.815366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.301329] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 257.302788] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 257.303907] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 257.304985] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 257.306106] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 257.307207] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 257.308293] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 257.309370] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 258.516124] Bluetooth: hci0: command 0x0c1a tx timeout [ 259.348234] Bluetooth: hci7: command 0x0c1a tx timeout [ 259.348287] Bluetooth: hci6: command 0x0c1a tx timeout [ 259.349177] Bluetooth: hci5: command 0x0c1a tx timeout [ 259.349963] Bluetooth: hci4: command 0x0c1a tx timeout [ 259.351583] Bluetooth: hci3: command 0x0c1a tx timeout [ 259.351610] Bluetooth: hci2: command 0x0c1a tx timeout [ 259.352413] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:30 executing program 1: accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000080)=0x80) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', r0, 0x4, 0x3, 0x4, 0x44b, 0x40, @private0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x40, 0x1, 0x2}}) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:30 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:30 executing program 4: openat$zero(0xffffffffffffff9c, 0x0, 0x8180, 0x0) 19:00:30 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:30 executing program 7: syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:30 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:30 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:30 executing program 0: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:30 executing program 0: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 266.408489] kmemleak: Found object by alias at 0x607f1a63974c [ 266.408512] CPU: 0 UID: 0 PID: 4709 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 266.408530] Tainted: [W]=WARN [ 266.408534] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 266.408541] Call Trace: [ 266.408545] [ 266.408550] dump_stack_lvl+0xca/0x120 [ 266.408575] __lookup_object+0x94/0xb0 [ 266.408591] delete_object_full+0x27/0x70 [ 266.408609] free_percpu+0x30/0x1160 [ 266.408628] ? arch_uprobe_clear_state+0x16/0x140 [ 266.408648] futex_hash_free+0x38/0xc0 [ 266.408661] mmput+0x2d3/0x390 [ 266.408680] do_exit+0x79d/0x2970 [ 266.408693] ? lock_release+0xc8/0x290 [ 266.408709] ? __pfx_do_exit+0x10/0x10 [ 266.408723] ? find_held_lock+0x2b/0x80 [ 266.408739] ? get_signal+0x835/0x2340 [ 266.408759] do_group_exit+0xd3/0x2a0 [ 266.408773] get_signal+0x2315/0x2340 [ 266.408792] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 266.408808] ? __pfx_get_signal+0x10/0x10 [ 266.408824] ? do_futex+0x135/0x370 [ 266.408837] ? __pfx_do_futex+0x10/0x10 [ 266.408851] arch_do_signal_or_restart+0x80/0x790 [ 266.408868] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 266.408887] ? __x64_sys_futex+0x1c9/0x4d0 [ 266.408899] ? __x64_sys_futex+0x1d2/0x4d0 [ 266.408913] ? fput_close_sync+0x114/0x240 [ 266.408928] ? __pfx___x64_sys_futex+0x10/0x10 [ 266.408940] ? __pfx_fput_close_sync+0x10/0x10 [ 266.408955] ? dnotify_flush+0x79/0x4c0 [ 266.408970] exit_to_user_mode_loop+0x8b/0x110 [ 266.408982] do_syscall_64+0x2f7/0x360 [ 266.408994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.409006] RIP: 0033:0x7fe7093d8b19 [ 266.409014] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 266.409019] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 266.409030] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 266.409038] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 266.409045] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 266.409051] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 266.409058] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 266.409074] [ 266.409077] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 266.409084] kmemleak: comm "syz-executor.7", pid 4715, jiffies 4294933191 [ 266.409091] kmemleak: min_count = 1 [ 266.409094] kmemleak: count = 0 [ 266.409098] kmemleak: flags = 0x21 [ 266.409101] kmemleak: checksum = 0 [ 266.409105] kmemleak: backtrace: [ 266.409108] pcpu_alloc_noprof+0x87a/0x1170 [ 266.409123] percpu_ref_init+0x37/0x400 [ 266.409141] io_uring_setup+0x44c/0x2000 [ 266.409152] __x64_sys_io_uring_setup+0xc8/0x170 [ 266.409163] do_syscall_64+0xbf/0x360 [ 266.409171] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:00:31 executing program 4: openat$zero(0xffffffffffffff9c, &(0x7f0000001940), 0x0, 0x0) 19:00:31 executing program 1: accept(0xffffffffffffffff, &(0x7f0000000000)=@xdp, &(0x7f0000000080)=0x80) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) 19:00:31 executing program 7: syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(0xffffffffffffffff, 0x6ab5, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:31 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:31 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:31 executing program 1: prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x12) [ 267.237165] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 267.238748] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 267.240241] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 267.241972] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 267.243715] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 267.245519] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 267.246895] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 267.248729] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 268.436118] Bluetooth: hci0: command 0x0c1a tx timeout [ 269.268161] Bluetooth: hci7: command 0x0c1a tx timeout [ 269.269233] Bluetooth: hci6: command 0x0c1a tx timeout [ 269.270242] Bluetooth: hci5: command 0x0c1a tx timeout [ 269.271254] Bluetooth: hci4: command 0x0c1a tx timeout [ 269.271281] Bluetooth: hci3: command 0x0c1a tx timeout [ 269.272223] Bluetooth: hci2: command 0x0c1a tx timeout [ 269.272674] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:41 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:00:41 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000140)) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:41 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:41 executing program 1: prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x12) 19:00:41 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:41 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:41 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x0, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:41 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:41 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:41 executing program 1: prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x12) 19:00:41 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:41 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 276.822793] kmemleak: Found object by alias at 0x607f1a63974c [ 276.822829] CPU: 0 UID: 0 PID: 4766 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 276.822861] Tainted: [W]=WARN [ 276.822868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 276.822880] Call Trace: [ 276.822887] [ 276.822895] dump_stack_lvl+0xca/0x120 [ 276.822935] __lookup_object+0x94/0xb0 [ 276.822972] delete_object_full+0x27/0x70 [ 276.823001] free_percpu+0x30/0x1160 [ 276.823029] ? arch_uprobe_clear_state+0x16/0x140 [ 276.823064] futex_hash_free+0x38/0xc0 [ 276.823089] mmput+0x2d3/0x390 [ 276.823122] do_exit+0x79d/0x2970 [ 276.823145] ? lock_release+0xc8/0x290 [ 276.823174] ? __pfx_do_exit+0x10/0x10 [ 276.823199] ? find_held_lock+0x2b/0x80 [ 276.823230] ? get_signal+0x835/0x2340 [ 276.823265] do_group_exit+0xd3/0x2a0 [ 276.823292] get_signal+0x2315/0x2340 [ 276.823327] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 276.823356] ? __pfx_get_signal+0x10/0x10 [ 276.823385] ? do_futex+0x135/0x370 [ 276.823410] ? __pfx_do_futex+0x10/0x10 [ 276.823437] arch_do_signal_or_restart+0x80/0x790 [ 276.823467] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 276.823496] ? __x64_sys_futex+0x1c9/0x4d0 [ 276.823518] ? __x64_sys_futex+0x1d2/0x4d0 [ 276.823543] ? fput_close_sync+0x114/0x240 [ 276.823571] ? __pfx___x64_sys_futex+0x10/0x10 [ 276.823594] ? __pfx_fput_close_sync+0x10/0x10 [ 276.823620] ? dnotify_flush+0x79/0x4c0 [ 276.823639] ? xfd_validate_state+0x55/0x180 [ 276.823676] exit_to_user_mode_loop+0x8b/0x110 [ 276.823698] do_syscall_64+0x2f7/0x360 [ 276.823718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.823739] RIP: 0033:0x7fe7093d8b19 [ 276.823755] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 276.823764] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 276.823784] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 276.823798] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 276.823810] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 276.823822] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 276.823835] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 276.823863] [ 276.823870] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 276.823881] kmemleak: comm "syz-executor.6", pid 4774, jiffies 4294943561 [ 276.823894] kmemleak: min_count = 1 [ 276.823901] kmemleak: count = 0 [ 276.823907] kmemleak: flags = 0x21 [ 276.823914] kmemleak: checksum = 0 [ 276.823920] kmemleak: backtrace: [ 276.823926] pcpu_alloc_noprof+0x87a/0x1170 [ 276.823953] percpu_ref_init+0x37/0x400 [ 276.823984] io_uring_setup+0x44c/0x2000 [ 276.824004] __x64_sys_io_uring_setup+0xc8/0x170 [ 276.824024] do_syscall_64+0xbf/0x360 [ 276.824039] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:00:41 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x0, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:41 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:41 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:41 executing program 1: prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x12) [ 277.477905] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 277.479344] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 277.481399] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 277.483364] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 277.485436] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 277.487625] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 277.489936] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 277.492202] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 278.676073] Bluetooth: hci0: command 0x0c1a tx timeout [ 279.508149] Bluetooth: hci7: command 0x0c1a tx timeout [ 279.508269] Bluetooth: hci6: command 0x0c1a tx timeout [ 279.508647] Bluetooth: hci5: command 0x0c1a tx timeout [ 279.509786] Bluetooth: hci4: command 0x0c1a tx timeout [ 279.510100] Bluetooth: hci3: command 0x0c1a tx timeout [ 279.511068] Bluetooth: hci2: command 0x0c1a tx timeout [ 279.511437] Bluetooth: hci1: command 0x0c1a tx timeout 19:00:49 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:49 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:00:49 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:49 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x0, 0x77e, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) 19:00:49 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:00:49 executing program 1: prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0x0) 19:00:49 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:49 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:49 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:50 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x0, 0x0, &(0x7f00000005c0)={[0x7]}, 0x8) [ 285.517320] kmemleak: Found object by alias at 0x607f1a63974c [ 285.517354] CPU: 0 UID: 0 PID: 4814 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 285.517386] Tainted: [W]=WARN [ 285.517393] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 285.517405] Call Trace: [ 285.517412] [ 285.517420] dump_stack_lvl+0xca/0x120 [ 285.517460] __lookup_object+0x94/0xb0 [ 285.517489] delete_object_full+0x27/0x70 [ 285.517517] free_percpu+0x30/0x1160 [ 285.517546] ? arch_uprobe_clear_state+0x16/0x140 [ 285.517580] futex_hash_free+0x38/0xc0 [ 285.517605] mmput+0x2d3/0x390 [ 285.517638] do_exit+0x79d/0x2970 [ 285.517662] ? lock_release+0xc8/0x290 [ 285.517692] ? __pfx_do_exit+0x10/0x10 [ 285.517717] ? find_held_lock+0x2b/0x80 [ 285.517747] ? get_signal+0x835/0x2340 [ 285.517782] do_group_exit+0xd3/0x2a0 [ 285.517809] get_signal+0x2315/0x2340 [ 285.517848] ? __fget_files+0x203/0x3b0 [ 285.517875] ? __pfx_get_signal+0x10/0x10 [ 285.517904] ? do_futex+0x135/0x370 [ 285.517929] ? __pfx_do_futex+0x10/0x10 [ 285.517956] arch_do_signal_or_restart+0x80/0x790 [ 285.517986] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 285.518016] ? __x64_sys_futex+0x1c9/0x4d0 [ 285.518038] ? __x64_sys_futex+0x1d2/0x4d0 [ 285.518063] ? fput_close_sync+0x114/0x240 [ 285.518091] ? __pfx___x64_sys_futex+0x10/0x10 [ 285.518114] ? __pfx_fput_close_sync+0x10/0x10 [ 285.518140] ? dnotify_flush+0x79/0x4c0 [ 285.518159] ? xfd_validate_state+0x55/0x180 [ 285.518195] exit_to_user_mode_loop+0x8b/0x110 [ 285.518218] do_syscall_64+0x2f7/0x360 [ 285.518239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.518261] RIP: 0033:0x7fe7093d8b19 [ 285.518276] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 285.518286] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 285.518306] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 285.518320] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 285.518332] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 285.518344] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 285.518357] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 285.518385] [ 285.518392] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 285.518404] kmemleak: comm "syz-executor.6", pid 4826, jiffies 4294952283 [ 285.518416] kmemleak: min_count = 1 [ 285.518423] kmemleak: count = 0 [ 285.518430] kmemleak: flags = 0x21 [ 285.518437] kmemleak: checksum = 0 [ 285.518443] kmemleak: backtrace: [ 285.518449] pcpu_alloc_noprof+0x87a/0x1170 [ 285.518476] percpu_ref_init+0x37/0x400 [ 285.518507] io_uring_setup+0x44c/0x2000 [ 285.518527] __x64_sys_io_uring_setup+0xc8/0x170 [ 285.518546] do_syscall_64+0xbf/0x360 [ 285.518562] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:00:50 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:50 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:50 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:00:50 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:00:50 executing program 7: r0 = syz_io_uring_setup(0x56b9, &(0x7f00000004c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000540), &(0x7f0000000580)) io_uring_enter(r0, 0x6ab5, 0x0, 0x0, 0x0, 0x0) 19:00:50 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:00:50 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 286.164300] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 286.166803] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 286.169392] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 286.171746] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 286.173682] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 286.174933] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 286.176828] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 286.179373] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 287.380068] Bluetooth: hci0: command 0x0c1a tx timeout [ 288.212280] Bluetooth: hci7: command 0x0c1a tx timeout [ 288.212308] Bluetooth: hci6: command 0x0c1a tx timeout [ 288.213485] Bluetooth: hci5: command 0x0c1a tx timeout [ 288.214298] Bluetooth: hci4: command 0x0c1a tx timeout [ 288.215298] Bluetooth: hci3: command 0x0c1a tx timeout [ 288.216069] Bluetooth: hci2: command 0x0c1a tx timeout [ 288.217095] Bluetooth: hci1: command 0x0c1a tx timeout 19:01:00 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:00 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:00 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:00 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:00 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:01:00 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:00 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:00 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:00 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:00 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 19:01:00 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) [ 296.335699] kmemleak: Found object by alias at 0x607f1a63974c [ 296.335735] CPU: 0 UID: 0 PID: 4890 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 296.335771] Tainted: [W]=WARN [ 296.335779] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 296.335792] Call Trace: [ 296.335800] [ 296.335809] dump_stack_lvl+0xca/0x120 [ 296.335852] __lookup_object+0x94/0xb0 [ 296.335883] delete_object_full+0x27/0x70 [ 296.335915] free_percpu+0x30/0x1160 [ 296.335947] ? arch_uprobe_clear_state+0x16/0x140 [ 296.335986] futex_hash_free+0x38/0xc0 [ 296.336022] mmput+0x2d3/0x390 [ 296.336059] do_exit+0x79d/0x2970 [ 296.336086] ? signal_wake_up_state+0x85/0x120 [ 296.336117] ? zap_other_threads+0x2b9/0x3a0 [ 296.336149] ? __pfx_do_exit+0x10/0x10 [ 296.336174] ? do_group_exit+0x1c3/0x2a0 [ 296.336202] ? lock_release+0xc8/0x290 [ 296.336235] do_group_exit+0xd3/0x2a0 [ 296.336265] __x64_sys_exit_group+0x3e/0x50 [ 296.336293] x64_sys_call+0x18c5/0x18d0 [ 296.336324] do_syscall_64+0xbf/0x360 [ 296.336347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.336369] RIP: 0033:0x7fe7093d8b19 [ 296.336386] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 296.336397] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 296.336419] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 296.336434] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 296.336448] RBP: 0000000000000000 R08: 0000001b2d122514 R09: 0000000000000000 [ 296.336462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.336475] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 296.336506] [ 296.336514] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 296.336527] kmemleak: comm "syz-executor.3", pid 4900, jiffies 4294963063 [ 296.336541] kmemleak: min_count = 1 [ 296.336549] kmemleak: count = 0 [ 296.336556] kmemleak: flags = 0x21 [ 296.336564] kmemleak: checksum = 0 [ 296.336571] kmemleak: backtrace: [ 296.336577] pcpu_alloc_noprof+0x87a/0x1170 [ 296.336608] percpu_ref_init+0x37/0x400 [ 296.336643] io_uring_setup+0x44c/0x2000 [ 296.336665] __x64_sys_io_uring_setup+0xc8/0x170 [ 296.336687] do_syscall_64+0xbf/0x360 [ 296.336704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.851867] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 296.854280] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 296.855518] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 296.857175] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 296.858304] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 296.859749] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 296.861307] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 296.862508] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 298.068185] Bluetooth: hci0: command 0x0c1a tx timeout [ 298.900185] Bluetooth: hci7: command 0x0c1a tx timeout [ 298.901569] Bluetooth: hci6: command 0x0c1a tx timeout [ 298.902691] Bluetooth: hci5: command 0x0c1a tx timeout [ 298.903779] Bluetooth: hci4: command 0x0c1a tx timeout [ 298.903817] Bluetooth: hci3: command 0x0c1a tx timeout [ 298.904839] Bluetooth: hci2: command 0x0c1a tx timeout [ 298.905290] Bluetooth: hci1: command 0x0c1a tx timeout 19:01:10 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:10 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:10 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) 19:01:10 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:10 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x2c140, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:10 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:10 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:10 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:10 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:10 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) [ 306.312592] kmemleak: Found object by alias at 0x607f1a63974c [ 306.312628] CPU: 1 UID: 0 PID: 4923 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 306.312664] Tainted: [W]=WARN [ 306.312671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 306.312684] Call Trace: [ 306.312692] [ 306.312701] dump_stack_lvl+0xca/0x120 [ 306.312758] __lookup_object+0x94/0xb0 [ 306.312796] delete_object_full+0x27/0x70 [ 306.312832] free_percpu+0x30/0x1160 [ 306.312863] ? arch_uprobe_clear_state+0x16/0x140 [ 306.312902] futex_hash_free+0x38/0xc0 [ 306.312935] mmput+0x2d3/0x390 [ 306.312979] do_exit+0x79d/0x2970 [ 306.313005] ? signal_wake_up_state+0x85/0x120 [ 306.313035] ? zap_other_threads+0x2b9/0x3a0 [ 306.313067] ? __pfx_do_exit+0x10/0x10 [ 306.313092] ? do_group_exit+0x1c3/0x2a0 [ 306.313119] ? lock_release+0xc8/0x290 [ 306.313152] do_group_exit+0xd3/0x2a0 [ 306.313182] __x64_sys_exit_group+0x3e/0x50 [ 306.313209] x64_sys_call+0x18c5/0x18d0 [ 306.313239] do_syscall_64+0xbf/0x360 [ 306.313262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.313284] RIP: 0033:0x7fe7093d8b19 [ 306.313302] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 306.313312] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 306.313334] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 306.313349] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 306.313363] RBP: 0000000000000000 R08: 0000001b2d1224ec R09: 0000000000000000 [ 306.313377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 306.313390] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 306.313421] [ 306.313428] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 306.313442] kmemleak: comm "syz-executor.6", pid 4937, jiffies 4294973051 [ 306.313456] kmemleak: min_count = 1 [ 306.313463] kmemleak: count = 0 [ 306.313471] kmemleak: flags = 0x21 [ 306.313478] kmemleak: checksum = 0 [ 306.313485] kmemleak: backtrace: [ 306.313492] pcpu_alloc_noprof+0x87a/0x1170 [ 306.313522] percpu_ref_init+0x37/0x400 [ 306.313556] io_uring_setup+0x44c/0x2000 [ 306.313578] __x64_sys_io_uring_setup+0xc8/0x170 [ 306.313600] do_syscall_64+0xbf/0x360 [ 306.313617] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:01:10 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:10 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:11 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:11 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:11 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) 19:01:11 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 307.009506] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 307.010717] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 307.012986] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 307.014223] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 307.015566] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 307.017368] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 307.019579] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 307.020745] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 308.244107] Bluetooth: hci0: command 0x0c1a tx timeout [ 309.012075] Bluetooth: hci1: command 0x0c1a tx timeout [ 309.076169] Bluetooth: hci7: command 0x0c1a tx timeout [ 309.077064] Bluetooth: hci6: command 0x0c1a tx timeout [ 309.077829] Bluetooth: hci5: command 0x0c1a tx timeout [ 309.077878] Bluetooth: hci4: command 0x0c1a tx timeout [ 309.078953] Bluetooth: hci3: command 0x0c1a tx timeout [ 309.079709] Bluetooth: hci2: command 0x0c1a tx timeout 19:01:21 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r0, 0x80083314, &(0x7f0000000080)) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:21 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:21 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:21 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:21 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) 19:01:21 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:21 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:21 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) [ 317.114758] kmemleak: Found object by alias at 0x607f1a63974c [ 317.114785] CPU: 1 UID: 0 PID: 4974 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 317.114811] Tainted: [W]=WARN [ 317.114817] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 317.114827] Call Trace: [ 317.114832] [ 317.114839] dump_stack_lvl+0xca/0x120 [ 317.114875] __lookup_object+0x94/0xb0 [ 317.114899] delete_object_full+0x27/0x70 [ 317.114923] free_percpu+0x30/0x1160 [ 317.114946] ? arch_uprobe_clear_state+0x16/0x140 [ 317.114975] futex_hash_free+0x38/0xc0 [ 317.115002] mmput+0x2d3/0x390 [ 317.115029] do_exit+0x79d/0x2970 [ 317.115049] ? signal_wake_up_state+0x85/0x120 [ 317.115071] ? zap_other_threads+0x2b9/0x3a0 [ 317.115094] ? __pfx_do_exit+0x10/0x10 [ 317.115113] ? do_group_exit+0x1c3/0x2a0 [ 317.115133] ? lock_release+0xc8/0x290 [ 317.115157] do_group_exit+0xd3/0x2a0 [ 317.115179] __x64_sys_exit_group+0x3e/0x50 [ 317.115199] x64_sys_call+0x18c5/0x18d0 [ 317.115221] do_syscall_64+0xbf/0x360 [ 317.115238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.115255] RIP: 0033:0x7fe7093d8b19 [ 317.115268] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 317.115276] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 317.115292] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 317.115303] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 317.115314] RBP: 0000000000000000 R08: 0000001b2d12276c R09: 0000000000000000 [ 317.115324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 317.115334] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 317.115357] [ 317.115363] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 317.115373] kmemleak: comm "syz-executor.3", pid 4985, jiffies 4294983907 [ 317.115383] kmemleak: min_count = 1 [ 317.115389] kmemleak: count = 0 [ 317.115394] kmemleak: flags = 0x21 [ 317.115399] kmemleak: checksum = 0 [ 317.115405] kmemleak: backtrace: [ 317.115410] pcpu_alloc_noprof+0x87a/0x1170 [ 317.115432] percpu_ref_init+0x37/0x400 [ 317.115457] io_uring_setup+0x44c/0x2000 [ 317.115473] __x64_sys_io_uring_setup+0xc8/0x170 [ 317.115489] do_syscall_64+0xbf/0x360 [ 317.115502] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:01:21 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:21 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000040)={0x9, 0x10000}) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:21 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:21 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:21 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:21 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:30 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:30 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:30 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) 19:01:30 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:30 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:30 executing program 5: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xd4140, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:30 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:30 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:30 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 325.775805] kmemleak: Found object by alias at 0x607f1a63974c [ 325.775829] CPU: 0 UID: 0 PID: 5027 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 325.775847] Tainted: [W]=WARN [ 325.775851] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 325.775858] Call Trace: [ 325.775862] [ 325.775867] dump_stack_lvl+0xca/0x120 [ 325.775896] __lookup_object+0x94/0xb0 [ 325.775913] delete_object_full+0x27/0x70 [ 325.775929] free_percpu+0x30/0x1160 [ 325.775945] ? arch_uprobe_clear_state+0x16/0x140 [ 325.775965] futex_hash_free+0x38/0xc0 [ 325.775980] mmput+0x2d3/0x390 [ 325.776003] do_exit+0x79d/0x2970 [ 325.776016] ? signal_wake_up_state+0x85/0x120 [ 325.776032] ? zap_other_threads+0x2b9/0x3a0 [ 325.776048] ? __pfx_do_exit+0x10/0x10 [ 325.776060] ? do_group_exit+0x1c3/0x2a0 [ 325.776073] ? lock_release+0xc8/0x290 [ 325.776090] do_group_exit+0xd3/0x2a0 [ 325.776105] __x64_sys_exit_group+0x3e/0x50 [ 325.776118] x64_sys_call+0x18c5/0x18d0 [ 325.776134] do_syscall_64+0xbf/0x360 [ 325.776146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.776157] RIP: 0033:0x7fe7093d8b19 [ 325.776166] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 325.776171] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 325.776184] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 325.776194] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 325.776201] RBP: 0000000000000000 R08: 0000001b2d1228f4 R09: 0000000000000000 [ 325.776208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 325.776215] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 325.776231] [ 325.776234] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 325.776241] kmemleak: comm "syz-executor.3", pid 5044, jiffies 4294992545 [ 325.776248] kmemleak: min_count = 1 [ 325.776252] kmemleak: count = 0 [ 325.776256] kmemleak: flags = 0x21 [ 325.776260] kmemleak: checksum = 0 [ 325.776265] kmemleak: backtrace: [ 325.776270] pcpu_alloc_noprof+0x87a/0x1170 [ 325.776285] percpu_ref_init+0x37/0x400 [ 325.776302] io_uring_setup+0x44c/0x2000 [ 325.776314] __x64_sys_io_uring_setup+0xc8/0x170 [ 325.776324] do_syscall_64+0xbf/0x360 [ 325.776333] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:01:39 executing program 5: openat$zero(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:39 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:39 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:39 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:39 executing program 1: pipe2$9p(&(0x7f0000000280), 0x0) 19:01:39 executing program 4: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:39 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:39 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:39 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:39 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:39 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:39 executing program 1: pipe2$9p(0x0, 0x0) 19:01:39 executing program 4: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:39 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:39 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:39 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x40, 0x0) 19:01:39 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:48 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r3 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r3}) 19:01:48 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:48 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x40, 0x0) 19:01:48 executing program 1: pipe2$9p(0x0, 0x0) 19:01:48 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:48 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:48 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:48 executing program 4: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:48 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:48 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:48 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x40, 0x0) 19:01:48 executing program 1: pipe2$9p(0x0, 0x0) 19:01:48 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:48 executing program 4: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:48 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r3 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r3}) 19:01:48 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:48 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 344.076750] kmemleak: Found object by alias at 0x607f1a63974c [ 344.076784] CPU: 1 UID: 0 PID: 5149 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 344.076819] Tainted: [W]=WARN [ 344.076827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 344.076840] Call Trace: [ 344.076847] [ 344.076856] dump_stack_lvl+0xca/0x120 [ 344.076901] __lookup_object+0x94/0xb0 [ 344.076932] delete_object_full+0x27/0x70 [ 344.076963] free_percpu+0x30/0x1160 [ 344.077001] ? arch_uprobe_clear_state+0x16/0x140 [ 344.077039] futex_hash_free+0x38/0xc0 [ 344.077065] mmput+0x2d3/0x390 [ 344.077100] do_exit+0x79d/0x2970 [ 344.077134] ? __pfx_do_exit+0x10/0x10 [ 344.077161] ? find_held_lock+0x2b/0x80 [ 344.077195] ? get_signal+0x835/0x2340 [ 344.077232] do_group_exit+0xd3/0x2a0 [ 344.077261] get_signal+0x2315/0x2340 [ 344.077295] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 344.077327] ? __pfx_get_signal+0x10/0x10 [ 344.077358] ? __schedule+0xe91/0x3590 [ 344.077396] arch_do_signal_or_restart+0x80/0x790 [ 344.077429] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 344.077461] ? __x64_sys_futex+0x1c9/0x4d0 [ 344.077485] ? __x64_sys_futex+0x1d2/0x4d0 [ 344.077511] ? fput_close_sync+0x114/0x240 [ 344.077542] ? __pfx___x64_sys_futex+0x10/0x10 [ 344.077566] ? __pfx_fput_close_sync+0x10/0x10 [ 344.077595] ? dnotify_flush+0x79/0x4c0 [ 344.077615] ? xfd_validate_state+0x55/0x180 [ 344.077655] exit_to_user_mode_loop+0x8b/0x110 [ 344.077680] do_syscall_64+0x2f7/0x360 [ 344.077703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.077726] RIP: 0033:0x7fe7093d8b19 [ 344.077743] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 344.077752] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 344.077774] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 344.077788] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 344.077802] RBP: 00007fe7094ebf60 R08: 0000000000000009 R09: 0000000000000000 [ 344.077816] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 344.077830] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 344.077861] [ 344.077868] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 344.077881] kmemleak: comm "syz-executor.6", pid 5160, jiffies 4295010872 [ 344.077894] kmemleak: min_count = 1 [ 344.077902] kmemleak: count = 0 [ 344.077909] kmemleak: flags = 0x21 [ 344.077916] kmemleak: checksum = 0 [ 344.077923] kmemleak: backtrace: [ 344.077929] pcpu_alloc_noprof+0x87a/0x1170 [ 344.077958] percpu_ref_init+0x37/0x400 [ 344.077991] io_uring_setup+0x44c/0x2000 [ 344.078012] __x64_sys_io_uring_setup+0xc8/0x170 [ 344.078034] do_syscall_64+0xbf/0x360 [ 344.078050] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:01:58 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:58 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x400c000) 19:01:58 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r3 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r3}) 19:01:58 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:58 executing program 4: getpeername(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:58 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x40, 0x0) 19:01:58 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:58 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:58 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:58 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) 19:01:58 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:01:58 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:58 executing program 4: getpeername(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:01:58 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x400c000) 19:01:58 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) 19:01:58 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:01:58 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:08 executing program 2: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:08 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x400c000) 19:02:08 executing program 5: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) 19:02:08 executing program 7: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:08 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r3 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r3}) 19:02:08 executing program 4: getpeername(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:08 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:08 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:08 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 363.622055] kmemleak: Found object by alias at 0x607f1a63974c [ 363.622089] CPU: 0 UID: 0 PID: 5225 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 363.622121] Tainted: [W]=WARN [ 363.622128] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 363.622140] Call Trace: [ 363.622147] [ 363.622155] dump_stack_lvl+0xca/0x120 [ 363.622194] __lookup_object+0x94/0xb0 [ 363.622222] delete_object_full+0x27/0x70 [ 363.622250] free_percpu+0x30/0x1160 [ 363.622279] ? arch_uprobe_clear_state+0x16/0x140 [ 363.622321] futex_hash_free+0x38/0xc0 [ 363.622344] mmput+0x2d3/0x390 [ 363.622377] do_exit+0x79d/0x2970 [ 363.622401] ? signal_wake_up_state+0x85/0x120 [ 363.622429] ? zap_other_threads+0x2b9/0x3a0 [ 363.622457] ? __pfx_do_exit+0x10/0x10 [ 363.622480] ? do_group_exit+0x1c3/0x2a0 [ 363.622504] ? lock_release+0xc8/0x290 [ 363.622534] do_group_exit+0xd3/0x2a0 [ 363.622561] __x64_sys_exit_group+0x3e/0x50 [ 363.622586] x64_sys_call+0x18c5/0x18d0 [ 363.622613] do_syscall_64+0xbf/0x360 [ 363.622634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.622654] RIP: 0033:0x7fe7093d8b19 [ 363.622669] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 363.622679] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 363.622699] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 363.622712] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 363.622725] RBP: 0000000000000000 R08: 0000001b2d122914 R09: 0000000000000000 [ 363.622737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 363.622749] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 363.622777] [ 363.622784] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 363.622796] kmemleak: comm "syz-executor.6", pid 5250, jiffies 4295030407 [ 363.622808] kmemleak: min_count = 1 [ 363.622815] kmemleak: count = 0 [ 363.622822] kmemleak: flags = 0x21 [ 363.622828] kmemleak: checksum = 0 [ 363.622835] kmemleak: backtrace: [ 363.622841] pcpu_alloc_noprof+0x87a/0x1170 [ 363.622868] percpu_ref_init+0x37/0x400 [ 363.622899] io_uring_setup+0x44c/0x2000 [ 363.622918] __x64_sys_io_uring_setup+0xc8/0x170 [ 363.622938] do_syscall_64+0xbf/0x360 [ 363.622953] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:08 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:08 executing program 7: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:08 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:08 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:08 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r2 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r2}) 19:02:17 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:17 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:17 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:17 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:17 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:17 executing program 7: pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:17 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:17 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 373.115624] kmemleak: Found object by alias at 0x607f1a63974c [ 373.115659] CPU: 1 UID: 0 PID: 5289 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 373.115697] Tainted: [W]=WARN [ 373.115704] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 373.115717] Call Trace: [ 373.115725] [ 373.115747] dump_stack_lvl+0xca/0x120 [ 373.115791] __lookup_object+0x94/0xb0 [ 373.115823] delete_object_full+0x27/0x70 [ 373.115856] free_percpu+0x30/0x1160 [ 373.115888] ? arch_uprobe_clear_state+0x16/0x140 [ 373.115927] futex_hash_free+0x38/0xc0 [ 373.115954] mmput+0x2d3/0x390 [ 373.115998] do_exit+0x79d/0x2970 [ 373.116025] ? signal_wake_up_state+0x85/0x120 [ 373.116056] ? zap_other_threads+0x2b9/0x3a0 [ 373.116087] ? __pfx_do_exit+0x10/0x10 [ 373.116113] ? do_group_exit+0x1c3/0x2a0 [ 373.116141] ? lock_release+0xc8/0x290 [ 373.116174] do_group_exit+0xd3/0x2a0 [ 373.116204] __x64_sys_exit_group+0x3e/0x50 [ 373.116232] x64_sys_call+0x18c5/0x18d0 [ 373.116262] do_syscall_64+0xbf/0x360 [ 373.116285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.116308] RIP: 0033:0x7fe7093d8b19 [ 373.116326] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 373.116336] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 373.116359] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 373.116374] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 373.116388] RBP: 0000000000000000 R08: 0000001b2d1228e4 R09: 0000000000000000 [ 373.116402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.116416] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 373.116448] [ 373.116455] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 373.116468] kmemleak: comm "syz-executor.6", pid 5297, jiffies 4295039734 [ 373.116483] kmemleak: min_count = 1 [ 373.116491] kmemleak: count = 0 [ 373.116498] kmemleak: flags = 0x21 [ 373.116506] kmemleak: checksum = 0 [ 373.116513] kmemleak: backtrace: [ 373.116520] pcpu_alloc_noprof+0x87a/0x1170 [ 373.116550] percpu_ref_init+0x37/0x400 [ 373.116584] io_uring_setup+0x44c/0x2000 [ 373.116606] __x64_sys_io_uring_setup+0xc8/0x170 [ 373.116628] do_syscall_64+0xbf/0x360 [ 373.116646] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:17 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:17 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:17 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:17 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x400c000) 19:02:17 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:18 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:18 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:18 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:18 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:18 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:27 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:27 executing program 0: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x0) 19:02:27 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:27 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:27 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:27 executing program 2: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:27 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:27 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:02:38 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:02:38 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:38 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:38 executing program 2: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:38 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:38 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:38 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 393.700883] kmemleak: Found object by alias at 0x607f1a63974c [ 393.700908] CPU: 1 UID: 0 PID: 5400 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 393.700926] Tainted: [W]=WARN [ 393.700929] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 393.700936] Call Trace: [ 393.700940] [ 393.700945] dump_stack_lvl+0xca/0x120 [ 393.700969] __lookup_object+0x94/0xb0 [ 393.700990] delete_object_full+0x27/0x70 [ 393.701006] free_percpu+0x30/0x1160 [ 393.701022] ? arch_uprobe_clear_state+0x16/0x140 [ 393.701042] futex_hash_free+0x38/0xc0 [ 393.701056] mmput+0x2d3/0x390 [ 393.701074] do_exit+0x79d/0x2970 [ 393.701087] ? lock_release+0xc8/0x290 [ 393.701104] ? __pfx_do_exit+0x10/0x10 [ 393.701117] ? find_held_lock+0x2b/0x80 [ 393.701134] ? get_signal+0x835/0x2340 [ 393.701153] do_group_exit+0xd3/0x2a0 [ 393.701167] get_signal+0x2315/0x2340 [ 393.701185] ? __fget_files+0x203/0x3b0 [ 393.701199] ? __pfx_get_signal+0x10/0x10 [ 393.701215] ? do_futex+0x135/0x370 [ 393.701228] ? __pfx_do_futex+0x10/0x10 [ 393.701243] arch_do_signal_or_restart+0x80/0x790 [ 393.701260] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 393.701276] ? __x64_sys_futex+0x1c9/0x4d0 [ 393.701287] ? __x64_sys_futex+0x1d2/0x4d0 [ 393.701301] ? fput_close_sync+0x114/0x240 [ 393.701316] ? __pfx___x64_sys_futex+0x10/0x10 [ 393.701328] ? __pfx_fput_close_sync+0x10/0x10 [ 393.701343] ? dnotify_flush+0x79/0x4c0 [ 393.701353] ? xfd_validate_state+0x55/0x180 [ 393.701373] exit_to_user_mode_loop+0x8b/0x110 [ 393.701386] do_syscall_64+0x2f7/0x360 [ 393.701397] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.701409] RIP: 0033:0x7fe7093d8b19 [ 393.701418] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 393.701423] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 393.701434] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 393.701442] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 393.701449] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 393.701455] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 393.701462] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 393.701477] [ 393.701481] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 393.701487] kmemleak: comm "syz-executor.6", pid 5410, jiffies 4295060476 [ 393.701494] kmemleak: min_count = 1 [ 393.701498] kmemleak: count = 0 [ 393.701501] kmemleak: flags = 0x21 [ 393.701505] kmemleak: checksum = 0 [ 393.701508] kmemleak: backtrace: [ 393.701512] pcpu_alloc_noprof+0x87a/0x1170 [ 393.701526] percpu_ref_init+0x37/0x400 [ 393.701544] io_uring_setup+0x44c/0x2000 [ 393.701555] __x64_sys_io_uring_setup+0xc8/0x170 [ 393.701566] do_syscall_64+0xbf/0x360 [ 393.701574] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:38 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:02:38 executing program 2: getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:38 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:38 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:38 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:38 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) [ 393.931386] kmemleak: Found object by alias at 0x607f1a63974c [ 393.931408] CPU: 1 UID: 0 PID: 5423 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 393.931426] Tainted: [W]=WARN [ 393.931429] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 393.931436] Call Trace: [ 393.931440] [ 393.931452] dump_stack_lvl+0xca/0x120 [ 393.931478] __lookup_object+0x94/0xb0 [ 393.931494] delete_object_full+0x27/0x70 [ 393.931510] free_percpu+0x30/0x1160 [ 393.931526] ? arch_uprobe_clear_state+0x16/0x140 [ 393.931546] futex_hash_free+0x38/0xc0 [ 393.931559] mmput+0x2d3/0x390 [ 393.931578] do_exit+0x79d/0x2970 [ 393.931591] ? signal_wake_up_state+0x85/0x120 [ 393.931607] ? zap_other_threads+0x2b9/0x3a0 [ 393.931626] ? __pfx_do_exit+0x10/0x10 [ 393.931639] ? do_group_exit+0x1c3/0x2a0 [ 393.931652] ? lock_release+0xc8/0x290 [ 393.931668] do_group_exit+0xd3/0x2a0 [ 393.931683] __x64_sys_exit_group+0x3e/0x50 [ 393.931696] x64_sys_call+0x18c5/0x18d0 [ 393.931711] do_syscall_64+0xbf/0x360 [ 393.931723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.931734] RIP: 0033:0x7fe7093d8b19 [ 393.931743] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 393.931748] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 393.931759] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 393.931767] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 393.931774] RBP: 0000000000000000 R08: 0000001b2d1228e8 R09: 0000000000000000 [ 393.931780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.931787] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 393.931802] [ 393.931806] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 393.931812] kmemleak: comm "syz-executor.6", pid 5410, jiffies 4295060476 [ 393.931819] kmemleak: min_count = 1 [ 393.931823] kmemleak: count = 0 [ 393.931826] kmemleak: flags = 0x21 [ 393.931830] kmemleak: checksum = 0 [ 393.931833] kmemleak: backtrace: [ 393.931837] pcpu_alloc_noprof+0x87a/0x1170 [ 393.931852] percpu_ref_init+0x37/0x400 [ 393.931869] io_uring_setup+0x44c/0x2000 [ 393.931881] __x64_sys_io_uring_setup+0xc8/0x170 [ 393.931892] do_syscall_64+0xbf/0x360 [ 393.931901] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:48 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:48 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:48 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:48 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:48 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:02:48 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:48 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:48 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:02:48 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) [ 404.060305] kmemleak: Found object by alias at 0x607f1a63974c [ 404.060340] CPU: 1 UID: 0 PID: 5448 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 404.060373] Tainted: [W]=WARN [ 404.060379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 404.060392] Call Trace: [ 404.060399] [ 404.060407] dump_stack_lvl+0xca/0x120 [ 404.060447] __lookup_object+0x94/0xb0 [ 404.060476] delete_object_full+0x27/0x70 [ 404.060505] free_percpu+0x30/0x1160 [ 404.060540] ? arch_uprobe_clear_state+0x16/0x140 [ 404.060575] futex_hash_free+0x38/0xc0 [ 404.060600] mmput+0x2d3/0x390 [ 404.060633] do_exit+0x79d/0x2970 [ 404.060657] ? signal_wake_up_state+0x85/0x120 [ 404.060684] ? zap_other_threads+0x2b9/0x3a0 [ 404.060713] ? __pfx_do_exit+0x10/0x10 [ 404.060736] ? do_group_exit+0x1c3/0x2a0 [ 404.060760] ? lock_release+0xc8/0x290 [ 404.060790] do_group_exit+0xd3/0x2a0 [ 404.060817] __x64_sys_exit_group+0x3e/0x50 [ 404.060842] x64_sys_call+0x18c5/0x18d0 [ 404.060869] do_syscall_64+0xbf/0x360 [ 404.060889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.060910] RIP: 0033:0x7fe7093d8b19 [ 404.060925] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 404.060934] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 404.060954] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 404.060968] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 404.060981] RBP: 0000000000000000 R08: 0000001b2d1228f0 R09: 0000000000000000 [ 404.060993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.061005] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 404.061033] [ 404.061040] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 404.061052] kmemleak: comm "syz-executor.6", pid 5467, jiffies 4295070788 [ 404.061066] kmemleak: min_count = 1 [ 404.061074] kmemleak: count = 0 [ 404.061081] kmemleak: flags = 0x21 [ 404.061089] kmemleak: checksum = 0 [ 404.061097] kmemleak: backtrace: [ 404.061103] pcpu_alloc_noprof+0x87a/0x1170 [ 404.061130] percpu_ref_init+0x37/0x400 [ 404.061161] io_uring_setup+0x44c/0x2000 [ 404.061181] __x64_sys_io_uring_setup+0xc8/0x170 [ 404.061201] do_syscall_64+0xbf/0x360 [ 404.061216] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:48 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:48 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 19:02:48 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:48 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:48 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:02:57 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 19:02:57 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:57 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:02:57 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:57 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:57 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:57 executing program 4: getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:02:57 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) 19:02:57 executing program 0: getsockname(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 19:02:57 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) [ 412.665708] kmemleak: Found object by alias at 0x607f1a63974c [ 412.665743] CPU: 0 UID: 0 PID: 5509 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 412.665776] Tainted: [W]=WARN [ 412.665783] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 412.665795] Call Trace: [ 412.665801] [ 412.665810] dump_stack_lvl+0xca/0x120 [ 412.665849] __lookup_object+0x94/0xb0 [ 412.665877] delete_object_full+0x27/0x70 [ 412.665906] free_percpu+0x30/0x1160 [ 412.665934] ? arch_uprobe_clear_state+0x16/0x140 [ 412.665969] futex_hash_free+0x38/0xc0 [ 412.666002] mmput+0x2d3/0x390 [ 412.666035] do_exit+0x79d/0x2970 [ 412.666059] ? lock_release+0xc8/0x290 [ 412.666088] ? __pfx_do_exit+0x10/0x10 [ 412.666113] ? find_held_lock+0x2b/0x80 [ 412.666143] ? get_signal+0x835/0x2340 [ 412.666179] do_group_exit+0xd3/0x2a0 [ 412.666206] get_signal+0x2315/0x2340 [ 412.666238] ? __fget_files+0x203/0x3b0 [ 412.666264] ? __pfx_get_signal+0x10/0x10 [ 412.666293] ? do_futex+0x135/0x370 [ 412.666318] ? __pfx_do_futex+0x10/0x10 [ 412.666345] arch_do_signal_or_restart+0x80/0x790 [ 412.666376] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 412.666405] ? __x64_sys_futex+0x1c9/0x4d0 [ 412.666427] ? __x64_sys_futex+0x1d2/0x4d0 [ 412.666452] ? fput_close_sync+0x114/0x240 [ 412.666480] ? __pfx___x64_sys_futex+0x10/0x10 [ 412.666503] ? __pfx_fput_close_sync+0x10/0x10 [ 412.666529] ? dnotify_flush+0x79/0x4c0 [ 412.666547] ? xfd_validate_state+0x55/0x180 [ 412.666584] exit_to_user_mode_loop+0x8b/0x110 [ 412.666607] do_syscall_64+0x2f7/0x360 [ 412.666628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.666648] RIP: 0033:0x7fe7093d8b19 [ 412.666664] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 412.666673] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 412.666694] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 412.666708] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 412.666720] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 412.666732] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 412.666745] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 412.666774] [ 412.666780] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 412.666792] kmemleak: comm "syz-executor.6", pid 5516, jiffies 4295079406 [ 412.666805] kmemleak: min_count = 1 [ 412.666812] kmemleak: count = 0 [ 412.666819] kmemleak: flags = 0x21 [ 412.666825] kmemleak: checksum = 0 [ 412.666832] kmemleak: backtrace: [ 412.666838] pcpu_alloc_noprof+0x87a/0x1170 [ 412.666865] percpu_ref_init+0x37/0x400 [ 412.666895] io_uring_setup+0x44c/0x2000 [ 412.666915] __x64_sys_io_uring_setup+0xc8/0x170 [ 412.666935] do_syscall_64+0xbf/0x360 [ 412.666950] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, &(0x7f0000000500), 0x80800) 19:02:57 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) 19:02:57 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:02:57 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:57 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x80800) 19:02:57 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(0xffffffffffffffff, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:02:57 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:02:57 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:02:57 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) [ 413.109966] kmemleak: Found object by alias at 0x607f1a63974c [ 413.110006] CPU: 0 UID: 0 PID: 5535 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 413.110039] Tainted: [W]=WARN [ 413.110045] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 413.110057] Call Trace: [ 413.110064] [ 413.110072] dump_stack_lvl+0xca/0x120 [ 413.110112] __lookup_object+0x94/0xb0 [ 413.110140] delete_object_full+0x27/0x70 [ 413.110169] free_percpu+0x30/0x1160 [ 413.110197] ? arch_uprobe_clear_state+0x16/0x140 [ 413.110231] futex_hash_free+0x38/0xc0 [ 413.110255] mmput+0x2d3/0x390 [ 413.110288] do_exit+0x79d/0x2970 [ 413.110312] ? signal_wake_up_state+0x85/0x120 [ 413.110339] ? zap_other_threads+0x2b9/0x3a0 [ 413.110367] ? __pfx_do_exit+0x10/0x10 [ 413.110389] ? do_group_exit+0x1c3/0x2a0 [ 413.110414] ? lock_release+0xc8/0x290 [ 413.110443] do_group_exit+0xd3/0x2a0 [ 413.110470] __x64_sys_exit_group+0x3e/0x50 [ 413.110494] x64_sys_call+0x18c5/0x18d0 [ 413.110521] do_syscall_64+0xbf/0x360 [ 413.110547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.110575] RIP: 0033:0x7fe7093d8b19 [ 413.110592] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 413.110601] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 413.110621] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 413.110634] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 413.110647] RBP: 0000000000000000 R08: 0000001b2d1228e8 R09: 0000000000000000 [ 413.110659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 413.110671] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 413.110699] [ 413.110706] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 413.110718] kmemleak: comm "syz-executor.4", pid 5544, jiffies 4295079864 [ 413.110730] kmemleak: min_count = 1 [ 413.110737] kmemleak: count = 0 [ 413.110744] kmemleak: flags = 0x21 [ 413.110750] kmemleak: checksum = 0 [ 413.110757] kmemleak: backtrace: [ 413.110762] pcpu_alloc_noprof+0x87a/0x1170 [ 413.110789] percpu_ref_init+0x37/0x400 [ 413.110825] io_uring_setup+0x44c/0x2000 [ 413.110850] __x64_sys_io_uring_setup+0xc8/0x170 [ 413.110869] do_syscall_64+0xbf/0x360 [ 413.110884] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:02:57 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:02:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x80800) 19:02:57 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:08 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:08 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:08 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:08 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x0) 19:03:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:08 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:08 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:08 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 423.892051] kmemleak: Found object by alias at 0x607f1a63974c [ 423.892073] CPU: 0 UID: 0 PID: 5600 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 423.892091] Tainted: [W]=WARN [ 423.892095] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 423.892101] Call Trace: [ 423.892106] [ 423.892110] dump_stack_lvl+0xca/0x120 [ 423.892138] __lookup_object+0x94/0xb0 [ 423.892155] delete_object_full+0x27/0x70 [ 423.892175] free_percpu+0x30/0x1160 [ 423.892191] ? arch_uprobe_clear_state+0x16/0x140 [ 423.892211] futex_hash_free+0x38/0xc0 [ 423.892225] mmput+0x2d3/0x390 [ 423.892243] do_exit+0x79d/0x2970 [ 423.892257] ? signal_wake_up_state+0x85/0x120 [ 423.892272] ? zap_other_threads+0x2b9/0x3a0 [ 423.892288] ? __pfx_do_exit+0x10/0x10 [ 423.892300] ? do_group_exit+0x1c3/0x2a0 [ 423.892317] ? lock_release+0xc8/0x290 [ 423.892334] do_group_exit+0xd3/0x2a0 [ 423.892349] __x64_sys_exit_group+0x3e/0x50 [ 423.892362] x64_sys_call+0x18c5/0x18d0 [ 423.892377] do_syscall_64+0xbf/0x360 [ 423.892389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.892400] RIP: 0033:0x7fe7093d8b19 [ 423.892409] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 423.892415] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 423.892426] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 423.892434] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 423.892441] RBP: 0000000000000000 R08: 0000001b2d1228fc R09: 0000000000000000 [ 423.892448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 423.892455] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 423.892470] [ 423.892474] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 423.892481] kmemleak: comm "syz-executor.4", pid 5609, jiffies 4295090660 [ 423.892488] kmemleak: min_count = 1 [ 423.892492] kmemleak: count = 0 [ 423.892496] kmemleak: flags = 0x21 [ 423.892499] kmemleak: checksum = 0 [ 423.892503] kmemleak: backtrace: [ 423.892507] pcpu_alloc_noprof+0x87a/0x1170 [ 423.892522] percpu_ref_init+0x37/0x400 [ 423.892539] io_uring_setup+0x44c/0x2000 [ 423.892550] __x64_sys_io_uring_setup+0xc8/0x170 [ 423.892561] do_syscall_64+0xbf/0x360 [ 423.892569] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:08 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 424.051422] kmemleak: Found object by alias at 0x607f1a63974c [ 424.051442] CPU: 0 UID: 0 PID: 5624 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 424.051460] Tainted: [W]=WARN [ 424.051464] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 424.051471] Call Trace: [ 424.051475] [ 424.051480] dump_stack_lvl+0xca/0x120 [ 424.051506] __lookup_object+0x94/0xb0 [ 424.051523] delete_object_full+0x27/0x70 [ 424.051539] free_percpu+0x30/0x1160 [ 424.051556] ? arch_uprobe_clear_state+0x16/0x140 [ 424.051575] futex_hash_free+0x38/0xc0 [ 424.051590] mmput+0x2d3/0x390 [ 424.051608] do_exit+0x79d/0x2970 [ 424.051625] ? __pfx_do_exit+0x10/0x10 [ 424.051639] ? find_held_lock+0x2b/0x80 [ 424.051657] ? get_signal+0x835/0x2340 [ 424.051676] do_group_exit+0xd3/0x2a0 [ 424.051691] get_signal+0x2315/0x2340 [ 424.051708] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 424.051725] ? __pfx_get_signal+0x10/0x10 [ 424.051740] ? __schedule+0xe91/0x3590 [ 424.051760] arch_do_signal_or_restart+0x80/0x790 [ 424.051778] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 424.051794] ? __x64_sys_futex+0x1c9/0x4d0 [ 424.051806] ? __x64_sys_futex+0x1d2/0x4d0 [ 424.051819] ? fput_close_sync+0x114/0x240 [ 424.051835] ? __pfx___x64_sys_futex+0x10/0x10 [ 424.051848] ? __pfx_fput_close_sync+0x10/0x10 [ 424.051862] ? dnotify_flush+0x79/0x4c0 [ 424.051873] ? xfd_validate_state+0x55/0x180 [ 424.051894] exit_to_user_mode_loop+0x8b/0x110 [ 424.051906] do_syscall_64+0x2f7/0x360 [ 424.051918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.051930] RIP: 0033:0x7fe7093d8b19 [ 424.051939] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 424.051944] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 424.051955] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 424.051962] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 424.051969] RBP: 00007fe7094ebf60 R08: 0000000000000009 R09: 0000000000000000 [ 424.051976] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 424.051988] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 424.052004] [ 424.052008] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 424.052014] kmemleak: comm "syz-executor.0", pid 5616, jiffies 4295090743 [ 424.052021] kmemleak: min_count = 1 [ 424.052025] kmemleak: count = 0 [ 424.052029] kmemleak: flags = 0x21 [ 424.052033] kmemleak: checksum = 0 [ 424.052036] kmemleak: backtrace: [ 424.052040] pcpu_alloc_noprof+0x87a/0x1170 [ 424.052054] percpu_ref_init+0x37/0x400 [ 424.052072] io_uring_setup+0x44c/0x2000 [ 424.052083] __x64_sys_io_uring_setup+0xc8/0x170 [ 424.052094] do_syscall_64+0xbf/0x360 [ 424.052102] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x0) 19:03:18 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:18 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:18 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:18 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:18 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:18 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:18 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) r4 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r4}) 19:03:18 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x0) 19:03:18 executing program 3: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:18 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:18 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:18 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:19 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:03:19 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:03:19 executing program 1: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:19 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 434.731912] kmemleak: Found object by alias at 0x607f1a63974c [ 434.731936] CPU: 1 UID: 0 PID: 5701 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 434.731955] Tainted: [W]=WARN [ 434.731959] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 434.731966] Call Trace: [ 434.731970] [ 434.731975] dump_stack_lvl+0xca/0x120 [ 434.732006] __lookup_object+0x94/0xb0 [ 434.732024] delete_object_full+0x27/0x70 [ 434.732040] free_percpu+0x30/0x1160 [ 434.732056] ? arch_uprobe_clear_state+0x16/0x140 [ 434.732076] futex_hash_free+0x38/0xc0 [ 434.732090] mmput+0x2d3/0x390 [ 434.732109] do_exit+0x79d/0x2970 [ 434.732123] ? signal_wake_up_state+0x85/0x120 [ 434.732139] ? zap_other_threads+0x2b9/0x3a0 [ 434.732154] ? __pfx_do_exit+0x10/0x10 [ 434.732166] ? do_group_exit+0x1c3/0x2a0 [ 434.732179] ? lock_release+0xc8/0x290 [ 434.732197] do_group_exit+0xd3/0x2a0 [ 434.732211] __x64_sys_exit_group+0x3e/0x50 [ 434.732225] x64_sys_call+0x18c5/0x18d0 [ 434.732240] do_syscall_64+0xbf/0x360 [ 434.732252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.732264] RIP: 0033:0x7fe7093d8b19 [ 434.732272] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 434.732277] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 434.732289] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 434.732296] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 434.732304] RBP: 0000000000000000 R08: 0000001b2d1228b8 R09: 0000000000000000 [ 434.732311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.732317] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 434.732333] [ 434.732337] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 434.732343] kmemleak: comm "syz-executor.4", pid 5699, jiffies 4295101484 [ 434.732350] kmemleak: min_count = 1 [ 434.732354] kmemleak: count = 0 [ 434.732358] kmemleak: flags = 0x21 [ 434.732362] kmemleak: checksum = 0 [ 434.732365] kmemleak: backtrace: [ 434.732369] pcpu_alloc_noprof+0x87a/0x1170 [ 434.732384] percpu_ref_init+0x37/0x400 [ 434.732401] io_uring_setup+0x44c/0x2000 [ 434.732413] __x64_sys_io_uring_setup+0xc8/0x170 [ 434.732424] do_syscall_64+0xbf/0x360 [ 434.732432] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:28 executing program 3: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:28 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) 19:03:28 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) 19:03:28 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:03:28 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:28 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:28 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:28 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:28 executing program 6: accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:29 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:29 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:29 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:03:38 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:38 executing program 6: accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:38 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r1 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r1}) 19:03:38 executing program 3: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:38 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:38 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) 19:03:38 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:03:38 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000500), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:38 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:38 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:38 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:03:38 executing program 6: accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) [ 454.287315] kmemleak: Found object by alias at 0x607f1a63974c [ 454.287349] CPU: 0 UID: 0 PID: 5794 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 454.287381] Tainted: [W]=WARN [ 454.287387] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 454.287399] Call Trace: [ 454.287406] [ 454.287414] dump_stack_lvl+0xca/0x120 [ 454.287453] __lookup_object+0x94/0xb0 [ 454.287482] delete_object_full+0x27/0x70 [ 454.287510] free_percpu+0x30/0x1160 [ 454.287539] ? arch_uprobe_clear_state+0x16/0x140 [ 454.287574] futex_hash_free+0x38/0xc0 [ 454.287598] mmput+0x2d3/0x390 [ 454.287631] do_exit+0x79d/0x2970 [ 454.287655] ? signal_wake_up_state+0x85/0x120 [ 454.287683] ? zap_other_threads+0x2b9/0x3a0 [ 454.287711] ? __pfx_do_exit+0x10/0x10 [ 454.287734] ? do_group_exit+0x1c3/0x2a0 [ 454.287758] ? lock_release+0xc8/0x290 [ 454.287788] do_group_exit+0xd3/0x2a0 [ 454.287815] __x64_sys_exit_group+0x3e/0x50 [ 454.287840] x64_sys_call+0x18c5/0x18d0 [ 454.287874] do_syscall_64+0xbf/0x360 [ 454.287894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.287915] RIP: 0033:0x7fe7093d8b19 [ 454.287930] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 454.287939] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 454.287959] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 454.287973] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 454.287986] RBP: 0000000000000000 R08: 0000001b2d122b64 R09: 0000000000000000 [ 454.287998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.288010] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 454.288038] [ 454.288045] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 454.288057] kmemleak: comm "syz-executor.5", pid 5789, jiffies 4295120820 [ 454.288070] kmemleak: min_count = 1 [ 454.288076] kmemleak: count = 0 [ 454.288083] kmemleak: flags = 0x21 [ 454.288090] kmemleak: checksum = 0 [ 454.288096] kmemleak: backtrace: [ 454.288102] pcpu_alloc_noprof+0x87a/0x1170 [ 454.288129] percpu_ref_init+0x37/0x400 [ 454.288160] io_uring_setup+0x44c/0x2000 [ 454.288179] __x64_sys_io_uring_setup+0xc8/0x170 [ 454.288199] do_syscall_64+0xbf/0x360 [ 454.288214] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:38 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:03:39 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:39 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r2) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:39 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:39 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:39 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:03:39 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) 19:03:39 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:39 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 454.846297] kmemleak: Found object by alias at 0x607f1a63974c [ 454.846330] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 454.846363] Tainted: [W]=WARN [ 454.846369] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 454.846381] Call Trace: [ 454.846388] [ 454.846396] dump_stack_lvl+0xca/0x120 [ 454.846434] __lookup_object+0x94/0xb0 [ 454.846462] delete_object_full+0x27/0x70 [ 454.846491] free_percpu+0x30/0x1160 [ 454.846519] ? arch_uprobe_clear_state+0x16/0x140 [ 454.846554] futex_hash_free+0x38/0xc0 [ 454.846578] mmput+0x2d3/0x390 [ 454.846611] do_exit+0x79d/0x2970 [ 454.846635] ? signal_wake_up_state+0x85/0x120 [ 454.846662] ? zap_other_threads+0x2b9/0x3a0 [ 454.846703] ? __pfx_do_exit+0x10/0x10 [ 454.846732] ? do_group_exit+0x1c3/0x2a0 [ 454.846756] ? lock_release+0xc8/0x290 [ 454.846786] do_group_exit+0xd3/0x2a0 [ 454.846812] __x64_sys_exit_group+0x3e/0x50 [ 454.846837] x64_sys_call+0x18c5/0x18d0 [ 454.846864] do_syscall_64+0xbf/0x360 [ 454.846885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.846905] RIP: 0033:0x7fe7093d8b19 [ 454.846921] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 454.846930] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 454.846950] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 454.846964] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 454.846977] RBP: 0000000000000000 R08: 0000001b2d122748 R09: 0000000000000000 [ 454.846989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.847001] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 454.847029] [ 454.847036] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 454.847047] kmemleak: comm "syz-executor.5", pid 5825, jiffies 4295121462 [ 454.847060] kmemleak: min_count = 1 [ 454.847067] kmemleak: count = 0 [ 454.847073] kmemleak: flags = 0x21 [ 454.847080] kmemleak: checksum = 0 [ 454.847087] kmemleak: backtrace: [ 454.847093] pcpu_alloc_noprof+0x87a/0x1170 [ 454.847119] percpu_ref_init+0x37/0x400 [ 454.847150] io_uring_setup+0x44c/0x2000 [ 454.847170] __x64_sys_io_uring_setup+0xc8/0x170 [ 454.847189] do_syscall_64+0xbf/0x360 [ 454.847205] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:48 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r2 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r3, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r1, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) 19:03:48 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:48 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:48 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:48 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:03:48 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:03:48 executing program 7: getsockname(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:48 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:49 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:49 executing program 7: syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) 19:03:49 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) [ 464.610447] kmemleak: Found object by alias at 0x607f1a63974c [ 464.610470] CPU: 0 UID: 0 PID: 5882 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 464.610488] Tainted: [W]=WARN [ 464.610491] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 464.610499] Call Trace: [ 464.610503] [ 464.610508] dump_stack_lvl+0xca/0x120 [ 464.610533] __lookup_object+0x94/0xb0 [ 464.610550] delete_object_full+0x27/0x70 [ 464.610566] free_percpu+0x30/0x1160 [ 464.610593] ? arch_uprobe_clear_state+0x16/0x140 [ 464.610612] futex_hash_free+0x38/0xc0 [ 464.610626] mmput+0x2d3/0x390 [ 464.610645] do_exit+0x79d/0x2970 [ 464.610662] ? __pfx_do_exit+0x10/0x10 [ 464.610675] ? find_held_lock+0x2b/0x80 [ 464.610693] ? get_signal+0x835/0x2340 [ 464.610713] do_group_exit+0xd3/0x2a0 [ 464.610727] get_signal+0x2315/0x2340 [ 464.610744] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 464.610760] ? __pfx_get_signal+0x10/0x10 [ 464.610776] ? __schedule+0xe91/0x3590 [ 464.610796] arch_do_signal_or_restart+0x80/0x790 [ 464.610813] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 464.610829] ? __x64_sys_futex+0x1c9/0x4d0 [ 464.610841] ? __x64_sys_futex+0x1d2/0x4d0 [ 464.610854] ? fput_close_sync+0x114/0x240 [ 464.610870] ? __pfx___x64_sys_futex+0x10/0x10 [ 464.610882] ? __pfx_fput_close_sync+0x10/0x10 [ 464.610897] ? dnotify_flush+0x79/0x4c0 [ 464.610907] ? xfd_validate_state+0x55/0x180 [ 464.610927] exit_to_user_mode_loop+0x8b/0x110 [ 464.610940] do_syscall_64+0x2f7/0x360 [ 464.610952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.610964] RIP: 0033:0x7fe7093d8b19 [ 464.610973] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 464.610978] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 464.610994] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 464.611003] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 464.611013] RBP: 00007fe7094ebf60 R08: 0000000000000009 R09: 0000000000000000 [ 464.611023] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 464.611033] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 464.611056] [ 464.611062] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 464.611068] kmemleak: comm "syz-executor.3", pid 5884, jiffies 4295131364 [ 464.611075] kmemleak: min_count = 1 [ 464.611079] kmemleak: count = 0 [ 464.611082] kmemleak: flags = 0x21 [ 464.611086] kmemleak: checksum = 0 [ 464.611090] kmemleak: backtrace: [ 464.611093] pcpu_alloc_noprof+0x87a/0x1170 [ 464.611108] percpu_ref_init+0x37/0x400 [ 464.611126] io_uring_setup+0x44c/0x2000 [ 464.611137] __x64_sys_io_uring_setup+0xc8/0x170 [ 464.611148] do_syscall_64+0xbf/0x360 [ 464.611156] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:49 executing program 7: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:59 executing program 7: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:59 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:03:59 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:03:59 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:59 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:03:59 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:03:59 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:59 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:03:59 executing program 7: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:03:59 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) [ 475.032498] kmemleak: Found object by alias at 0x607f1a63974c [ 475.032532] CPU: 0 UID: 0 PID: 5913 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 475.032565] Tainted: [W]=WARN [ 475.032572] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 475.032584] Call Trace: [ 475.032591] [ 475.032599] dump_stack_lvl+0xca/0x120 [ 475.032639] __lookup_object+0x94/0xb0 [ 475.032668] delete_object_full+0x27/0x70 [ 475.032696] free_percpu+0x30/0x1160 [ 475.032725] ? arch_uprobe_clear_state+0x16/0x140 [ 475.032760] futex_hash_free+0x38/0xc0 [ 475.032785] mmput+0x2d3/0x390 [ 475.032818] do_exit+0x79d/0x2970 [ 475.032842] ? lock_release+0xc8/0x290 [ 475.032871] ? __pfx_do_exit+0x10/0x10 [ 475.032903] ? find_held_lock+0x2b/0x80 [ 475.032934] ? get_signal+0x835/0x2340 [ 475.032969] do_group_exit+0xd3/0x2a0 [ 475.032996] get_signal+0x2315/0x2340 [ 475.033028] ? __fget_files+0x203/0x3b0 [ 475.033054] ? __pfx_get_signal+0x10/0x10 [ 475.033083] ? do_futex+0x135/0x370 [ 475.033108] ? __pfx_do_futex+0x10/0x10 [ 475.033135] arch_do_signal_or_restart+0x80/0x790 [ 475.033166] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 475.033195] ? __x64_sys_futex+0x1c9/0x4d0 [ 475.033217] ? __x64_sys_futex+0x1d2/0x4d0 [ 475.033242] ? fput_close_sync+0x114/0x240 [ 475.033271] ? __pfx___x64_sys_futex+0x10/0x10 [ 475.033293] ? __pfx_fput_close_sync+0x10/0x10 [ 475.033320] ? dnotify_flush+0x79/0x4c0 [ 475.033338] ? xfd_validate_state+0x55/0x180 [ 475.033375] exit_to_user_mode_loop+0x8b/0x110 [ 475.033398] do_syscall_64+0x2f7/0x360 [ 475.033419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.033440] RIP: 0033:0x7fe7093d8b19 [ 475.033455] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 475.033464] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 475.033484] RAX: fffffffffffffe00 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 475.033498] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe7094ebf68 [ 475.033511] RBP: 00007fe7094ebf60 R08: 0000000000000000 R09: 0000000000000000 [ 475.033523] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7094ebf6c [ 475.033535] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 475.033564] [ 475.033570] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 475.033582] kmemleak: comm "syz-executor.3", pid 5927, jiffies 4295141753 [ 475.033595] kmemleak: min_count = 1 [ 475.033602] kmemleak: count = 0 [ 475.033608] kmemleak: flags = 0x21 [ 475.033615] kmemleak: checksum = 0 [ 475.033622] kmemleak: backtrace: [ 475.033628] pcpu_alloc_noprof+0x87a/0x1170 [ 475.033655] percpu_ref_init+0x37/0x400 [ 475.033686] io_uring_setup+0x44c/0x2000 [ 475.033705] __x64_sys_io_uring_setup+0xc8/0x170 [ 475.033725] do_syscall_64+0xbf/0x360 [ 475.033740] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:03:59 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:59 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, 0x0, &(0x7f0000000500), 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:03:59 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:03:59 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:03:59 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:03:59 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:00 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:04:00 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', 0x0, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:04:00 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000001500)) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:08 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:04:08 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:08 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:08 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:08 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:04:08 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:08 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:08 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:08 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) [ 484.368445] kmemleak: Found object by alias at 0x607f1a63974c [ 484.368479] CPU: 1 UID: 0 PID: 5998 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 484.368512] Tainted: [W]=WARN [ 484.368519] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 484.368532] Call Trace: [ 484.368538] [ 484.368546] dump_stack_lvl+0xca/0x120 [ 484.368590] __lookup_object+0x94/0xb0 [ 484.368619] delete_object_full+0x27/0x70 [ 484.368648] free_percpu+0x30/0x1160 [ 484.368677] ? arch_uprobe_clear_state+0x16/0x140 [ 484.368712] futex_hash_free+0x38/0xc0 [ 484.368737] mmput+0x2d3/0x390 [ 484.368771] do_exit+0x79d/0x2970 [ 484.368795] ? signal_wake_up_state+0x85/0x120 [ 484.368823] ? zap_other_threads+0x2b9/0x3a0 [ 484.368851] ? __pfx_do_exit+0x10/0x10 [ 484.368874] ? do_group_exit+0x1c3/0x2a0 [ 484.368899] ? lock_release+0xc8/0x290 [ 484.368929] do_group_exit+0xd3/0x2a0 [ 484.368955] __x64_sys_exit_group+0x3e/0x50 [ 484.368981] x64_sys_call+0x18c5/0x18d0 [ 484.369017] do_syscall_64+0xbf/0x360 [ 484.369038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.369059] RIP: 0033:0x7fe7093d8b19 [ 484.369075] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 484.369084] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 484.369104] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 484.369118] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 484.369131] RBP: 0000000000000000 R08: 0000001b2d1228e0 R09: 0000000000000000 [ 484.369144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.369156] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 484.369185] [ 484.369192] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 484.369203] kmemleak: comm "syz-executor.5", pid 6018, jiffies 4295151119 [ 484.369217] kmemleak: min_count = 1 [ 484.369223] kmemleak: count = 0 [ 484.369230] kmemleak: flags = 0x21 [ 484.369237] kmemleak: checksum = 0 [ 484.369244] kmemleak: backtrace: [ 484.369249] pcpu_alloc_noprof+0x87a/0x1170 [ 484.369276] percpu_ref_init+0x37/0x400 [ 484.369308] io_uring_setup+0x44c/0x2000 [ 484.369327] __x64_sys_io_uring_setup+0xc8/0x170 [ 484.369347] do_syscall_64+0xbf/0x360 [ 484.369363] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:04:17 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:17 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:17 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r2, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:04:17 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:17 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r1 = socket(0x29, 0x5, 0x5) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r1) 19:04:17 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:17 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:17 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:17 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:18 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) [ 493.539603] kmemleak: Found object by alias at 0x607f1a63974c [ 493.539637] CPU: 0 UID: 0 PID: 6042 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 493.539669] Tainted: [W]=WARN [ 493.539676] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 493.539689] Call Trace: [ 493.539695] [ 493.539704] dump_stack_lvl+0xca/0x120 [ 493.539743] __lookup_object+0x94/0xb0 [ 493.539771] delete_object_full+0x27/0x70 [ 493.539800] free_percpu+0x30/0x1160 [ 493.539828] ? arch_uprobe_clear_state+0x16/0x140 [ 493.539863] futex_hash_free+0x38/0xc0 [ 493.539887] mmput+0x2d3/0x390 [ 493.539920] do_exit+0x79d/0x2970 [ 493.539944] ? signal_wake_up_state+0x85/0x120 [ 493.539972] ? zap_other_threads+0x2b9/0x3a0 [ 493.540007] ? __pfx_do_exit+0x10/0x10 [ 493.540030] ? do_group_exit+0x1c3/0x2a0 [ 493.540054] ? lock_release+0xc8/0x290 [ 493.540084] do_group_exit+0xd3/0x2a0 [ 493.540111] __x64_sys_exit_group+0x3e/0x50 [ 493.540136] x64_sys_call+0x18c5/0x18d0 [ 493.540163] do_syscall_64+0xbf/0x360 [ 493.540184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.540204] RIP: 0033:0x7fe7093d8b19 [ 493.540219] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 493.540229] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 493.540249] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 493.540262] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 493.540275] RBP: 0000000000000000 R08: 0000001b2d12291c R09: 0000000000000000 [ 493.540287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.540299] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 493.540327] [ 493.540334] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 493.540346] kmemleak: comm "syz-executor.5", pid 6057, jiffies 4295160204 [ 493.540359] kmemleak: min_count = 1 [ 493.540365] kmemleak: count = 0 [ 493.540372] kmemleak: flags = 0x21 [ 493.540379] kmemleak: checksum = 0 [ 493.540385] kmemleak: backtrace: [ 493.540391] pcpu_alloc_noprof+0x87a/0x1170 [ 493.540418] percpu_ref_init+0x37/0x400 [ 493.540449] io_uring_setup+0x44c/0x2000 [ 493.540469] __x64_sys_io_uring_setup+0xc8/0x170 [ 493.540489] do_syscall_64+0xbf/0x360 [ 493.540504] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:04:18 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000001500)) accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000001640)) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:18 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:18 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x0, 0x80800) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:18 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:18 executing program 1: syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:18 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:04:18 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000001500)) accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000001640)) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:18 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r1, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:04:18 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) r0 = socket(0x29, 0x5, 0x5) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r0) 19:04:18 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) [ 494.244947] kmemleak: Found object by alias at 0x607f1a63974c [ 494.244980] CPU: 0 UID: 0 PID: 6104 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 494.245019] Tainted: [W]=WARN [ 494.245026] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 494.245039] Call Trace: [ 494.245046] [ 494.245054] dump_stack_lvl+0xca/0x120 [ 494.245093] __lookup_object+0x94/0xb0 [ 494.245121] delete_object_full+0x27/0x70 [ 494.245150] free_percpu+0x30/0x1160 [ 494.245179] ? arch_uprobe_clear_state+0x16/0x140 [ 494.245213] futex_hash_free+0x38/0xc0 [ 494.245238] mmput+0x2d3/0x390 [ 494.245271] do_exit+0x79d/0x2970 [ 494.245295] ? signal_wake_up_state+0x85/0x120 [ 494.245322] ? zap_other_threads+0x2b9/0x3a0 [ 494.245351] ? __pfx_do_exit+0x10/0x10 [ 494.245374] ? do_group_exit+0x1c3/0x2a0 [ 494.245398] ? lock_release+0xc8/0x290 [ 494.245428] do_group_exit+0xd3/0x2a0 [ 494.245455] __x64_sys_exit_group+0x3e/0x50 [ 494.245480] x64_sys_call+0x18c5/0x18d0 [ 494.245507] do_syscall_64+0xbf/0x360 [ 494.245527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.245547] RIP: 0033:0x7fe7093d8b19 [ 494.245563] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 494.245572] RSP: 002b:00007ffc7dcf70b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 494.245592] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fe7093d8b19 [ 494.245606] RDX: 00007fe70938b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 494.245618] RBP: 0000000000000000 R08: 0000001b2d122898 R09: 0000000000000000 [ 494.245631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.245643] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc7dcf71a0 [ 494.245671] [ 494.245677] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 494.245689] kmemleak: comm "syz-executor.7", pid 6102, jiffies 4295160880 [ 494.245702] kmemleak: min_count = 1 [ 494.245709] kmemleak: count = 0 [ 494.245715] kmemleak: flags = 0x21 [ 494.245722] kmemleak: checksum = 0 [ 494.245729] kmemleak: backtrace: [ 494.245735] pcpu_alloc_noprof+0x87a/0x1170 [ 494.245762] percpu_ref_init+0x37/0x400 [ 494.245793] io_uring_setup+0x44c/0x2000 [ 494.245813] __x64_sys_io_uring_setup+0xc8/0x170 [ 494.245832] do_syscall_64+0xbf/0x360 [ 494.245848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.077347] ------------[ cut here ]------------ [ 497.078574] WARNING: io_uring/io_uring.c:3040 at io_ring_exit_work+0xc86/0xf60, CPU#1: kworker/u10:5/344 [ 497.080438] Modules linked in: [ 497.081184] CPU: 1 UID: 0 PID: 344 Comm: kworker/u10:5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 497.083424] Tainted: [W]=WARN [ 497.084062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 497.085651] Workqueue: iou_exit io_ring_exit_work [ 497.086654] RIP: 0010:io_ring_exit_work+0xc86/0xf60 [ 497.091806] Code: 65 48 2b 05 e4 fc 3d 05 0f 85 55 01 00 00 48 81 c4 40 01 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 c0 d3 77 02 e8 3b b4 2d ff 90 <0f> 0b 90 48 c7 44 24 08 60 ea 00 00 e9 13 f7 ff ff e8 24 b4 2d ff [ 497.095231] RSP: 0018:ffff88801706fb08 EFLAGS: 00010293 [ 497.096287] RAX: 0000000000000000 RBX: ffff8880172866c8 RCX: ffffffff82462a61 [ 497.097681] RDX: ffff88801728b700 RSI: ffffffff82463345 RDI: 0000000000000007 [ 497.099060] RBP: ffff888017286000 R08: 0000000000000001 R09: ffffed1002e0df4a [ 497.100437] R10: ffffffffffffffe0 R11: 0000000000000000 R12: dffffc0000000000 [ 497.101802] R13: ffffffffffffffe0 R14: ffff88801728603f R15: ffff888017286040 [ 497.103200] FS: 0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 497.104747] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 497.105907] CR2: 000055cad3f027f0 CR3: 0000000014221000 CR4: 0000000000350ef0 [ 497.107312] Call Trace: [ 497.107824] [ 497.108311] ? __lock_acquire+0xc65/0x1b70 [ 497.109189] ? __pfx_io_ring_exit_work+0x10/0x10 [ 497.110139] ? finish_task_switch.isra.0+0x201/0x840 [ 497.110962] ? lock_acquire+0x15e/0x2f0 [ 497.111609] ? process_one_work+0x857/0x19c0 [ 497.112425] ? lock_release+0xc8/0x290 [ 497.113218] process_one_work+0x8e1/0x19c0 [ 497.114039] ? __pfx_process_one_work+0x10/0x10 [ 497.114904] ? move_linked_works+0x172/0x270 [ 497.115771] ? assign_work+0x196/0x240 [ 497.116539] worker_thread+0x67e/0xe90 [ 497.117308] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 497.118347] ? __pfx_worker_thread+0x10/0x10 [ 497.119223] kthread+0x3c8/0x740 [ 497.119862] ? __pfx_kthread+0x10/0x10 [ 497.120631] ? ret_from_fork+0x23/0x430 [ 497.121425] ? lock_release+0xc8/0x290 [ 497.122165] ? __pfx_kthread+0x10/0x10 [ 497.122908] ret_from_fork+0x34b/0x430 [ 497.123675] ? __pfx_kthread+0x10/0x10 [ 497.124446] ret_from_fork_asm+0x1a/0x30 [ 497.125239] [ 497.125667] irq event stamp: 253421 [ 497.126360] hardirqs last enabled at (253431): [] __up_console_sem+0x78/0x80 [ 497.128015] hardirqs last disabled at (253440): [] __up_console_sem+0x5d/0x80 [ 497.129621] softirqs last enabled at (253000): [] handle_softirqs+0x50c/0x770 [ 497.131305] softirqs last disabled at (253459): [] __irq_exit_rcu+0xc4/0x100 [ 497.132917] ---[ end trace 0000000000000000 ]--- 19:04:28 executing program 1: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:04:28 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:28 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000001500)) accept$inet(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:28 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:28 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) 19:04:28 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:04:28 executing program 4: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x29, 0x5, 0x5) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r0) 19:04:28 executing program 5: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r0 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r1, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c}) 19:04:29 executing program 1: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:04:29 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:29 executing program 6: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000001500)) accept$inet(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) r0 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r0}) 19:04:29 executing program 1: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) [ 504.682312] kmemleak: Found object by alias at 0x607f1a63974c [ 504.682342] CPU: 1 UID: 0 PID: 6165 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 504.682367] Tainted: [W]=WARN [ 504.682372] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 504.682381] Call Trace: [ 504.682386] [ 504.682393] dump_stack_lvl+0xca/0x120 [ 504.682425] __lookup_object+0x94/0xb0 [ 504.682447] delete_object_full+0x27/0x70 [ 504.682468] free_percpu+0x30/0x1160 [ 504.682491] ? arch_uprobe_clear_state+0x16/0x140 [ 504.682518] futex_hash_free+0x38/0xc0 [ 504.682537] mmput+0x2d3/0x390 [ 504.682562] do_exit+0x79d/0x2970 [ 504.682586] ? __pfx_do_exit+0x10/0x10 [ 504.682605] ? find_held_lock+0x2b/0x80 [ 504.682629] ? get_signal+0x835/0x2340 [ 504.682656] do_group_exit+0xd3/0x2a0 [ 504.682677] get_signal+0x2315/0x2340 [ 504.682700] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 504.682723] ? __pfx_get_signal+0x10/0x10 [ 504.682745] ? __schedule+0xe91/0x3590 [ 504.682772] arch_do_signal_or_restart+0x80/0x790 [ 504.682796] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 504.682818] ? __x64_sys_futex+0x1c9/0x4d0 [ 504.682834] ? __x64_sys_futex+0x1d2/0x4d0 [ 504.682853] ? fput_close_sync+0x114/0x240 [ 504.682875] ? __pfx___x64_sys_futex+0x10/0x10 [ 504.682892] ? __pfx_fput_close_sync+0x10/0x10 [ 504.682912] ? dnotify_flush+0x79/0x4c0 [ 504.682926] ? xfd_validate_state+0x55/0x180 [ 504.682955] exit_to_user_mode_loop+0x8b/0x110 [ 504.682972] do_syscall_64+0x2f7/0x360 [ 504.682993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.683009] RIP: 0033:0x7fe7093d8b19 [ 504.683021] Code: Unable to access opcode bytes at 0x7fe7093d8aef. [ 504.683028] RSP: 002b:00007fe70694e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 504.683044] RAX: 0000000000000001 RBX: 00007fe7094ebf68 RCX: 00007fe7093d8b19 [ 504.683054] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7094ebf6c [ 504.683064] RBP: 00007fe7094ebf60 R08: 0000000000000009 R09: 0000000000000000 [ 504.683073] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fe7094ebf6c [ 504.683083] R13: 00007ffc7dcf6e8f R14: 00007fe70694e300 R15: 0000000000022000 [ 504.683105] [ 504.683110] kmemleak: Object (percpu) 0x607f1a639748 (size 8): [ 504.683119] kmemleak: comm "syz-executor.5", pid 6150, jiffies 4295171236 [ 504.683129] kmemleak: min_count = 1 [ 504.683134] kmemleak: count = 0 [ 504.683139] kmemleak: flags = 0x21 [ 504.683144] kmemleak: checksum = 0 [ 504.683149] kmemleak: backtrace: [ 504.683154] pcpu_alloc_noprof+0x87a/0x1170 [ 504.683175] percpu_ref_init+0x37/0x400 [ 504.683199] io_uring_setup+0x44c/0x2000 [ 504.683214] __x64_sys_io_uring_setup+0xc8/0x170 [ 504.683229] do_syscall_64+0xbf/0x360 [ 504.683240] entry_SYSCALL_64_after_hwframe+0x77/0x7f 19:04:29 executing program 0: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) socket$inet(0x2, 0x5, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), 0xffffffffffffffff) 19:04:29 executing program 1: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 19:04:29 executing program 2: getsockname(0xffffffffffffffff, &(0x7f00000000c0)=@tipc, &(0x7f0000000140)=0x80) ioctl$SNAPSHOT_PLATFORM_SUPPORT(0xffffffffffffffff, 0x330f, 0x8) accept$inet(0xffffffffffffffff, 0x0, 0x0) pipe2$9p(&(0x7f0000000280), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000480)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000500)=0x80, 0x80800) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x84000840}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x80, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x400c000) 19:04:29 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, &(0x7f00000000c0)=0x80) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) 19:04:29 executing program 3: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@ethernet, 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f0000000100)=@x25, &(0x7f0000000180)=0x80, 0x0) socket$inet(0x2, 0x5, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept4$inet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x4, 0x2, 0x6, 0x90b9df2, 0x10, @dev={0xfe, 0x80, '\x00', 0x43}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x10, 0x1, 0x4a}}) r3 = socket(0x29, 0x5, 0x5) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001400)={{{@in, @in6=@ipv4={""/10, ""/2, @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f00000015c0)={'sit0\x00', &(0x7f0000001540)={'ip6tnl0\x00', r4, 0x2f, 0x5, 0xb1, 0x5, 0x40, @dev={0xfe, 0x80, '\x00', 0x1f}, @private0, 0x10, 0x1, 0x5, 0x4}}) accept$inet(0xffffffffffffffff, &(0x7f0000001600)={0x2, 0x0, @empty}, &(0x7f0000001640)=0x10) accept(r2, &(0x7f0000001680)=@caif=@rfm, &(0x7f0000001700)=0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000001740), r3) r5 = syz_io_uring_setup(0x297e, &(0x7f00000018c0)={0x0, 0x242f, 0x8, 0x2, 0x99}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000001940), &(0x7f0000001980)) io_uring_setup(0x2564, &(0x7f00000019c0)={0x0, 0xc5be, 0x8, 0x1, 0x16c, 0x0, r5}) VM DIAGNOSIS: 19:04:21 Registers: info registers vcpu 0 RAX=ffff888016269b80 RBX=ffffc9000aea0f78 RCX=0000000000004002 RDX=ffff888016269b80 RSI=0000000000000004 RDI=ffff888018f97b48 RBP=0000000000000000 RSP=ffff888018f97bd0 R8 =0000000000000001 R9 =ffffed10031f2f69 R10=0000000000000003 R11=0000000000000001 R12=ffffc9000aea0ff9 R13=ffff888009c1a4a0 R14=ffff888016269b80 R15=0000000000000086 RIP=ffffffff81afbe5c RFL=00000097 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555941f2400 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe3d00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f520a969d20 CR3=000000000ff83000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=1be1fe33cf68f594f141379ab9d36265 XMM02=6b1e99b806172e3b00000000000aea28 XMM03=ac8bc31478ec851100000000000aefa0 XMM04=4465be7b24fe38460000000000215788 XMM05=d3fdd5f48436fbd700000000000aead0 XMM06=1b546cb59eab0cfe00000000000ae988 XMM07=a1fcdcf819d7e1e500000000000ae728 XMM08=44495f474f4c5359530069253d595449 XMM09=00000000000000000000000000000000 XMM10=00000000000000000020002000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000000005f RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff88801706f438 R8 =0000000000000000 R9 =ffffed10016ea046 R10=000000000000005f R11=0000000000000001 R12=000000000000005f R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe5800000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055cad3f027f0 CR3=0000000014221000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=0000000000000000410dde0000000000 XMM03=0000ff00000000000000000000000000 XMM04=732f6c61636f6c2f7273752f3d485441 XMM05=622f6c61636f6c2f7273752f3a6e6962 XMM06=73752f3a6e6962732f7273752f3a6e69 XMM07=6e69622f3a6e6962732f3a6e69622f72 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000