0000001d00)={&(0x7f0000001c40)={0xc0, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:26 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:26 executing program 4: syz_open_procfs$namespace(0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f00000005c0)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:26 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000001800)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001680)={0x12c, 0x0, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x12c}}, 0x84) syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:23:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x40, 0x0, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:26 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:26 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:27 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x40, 0x0, 0x0, 0x0, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:27 executing program 4: syz_open_procfs$namespace(0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f00000005c0)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:27 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:37 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x40, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:37 executing program 4: syz_open_procfs$namespace(0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f00000005c0)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:37 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000001800)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001680)={0x12c, 0x0, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x12c}}, 0x84) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:23:37 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @multicast2}, 0x1, 0x3, 0x4, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)="84fd2cf5ae8b895c40145344a63f026bff1b033452b26d017caee0e968fab3c39dbe318eae13b3fecc96c93f7e1b291ae2f7091d46e7cceea568b8db14b130f7d1d3eab1ac32b01548cb822aec22d66a2d7326d2fed28ccc1b201ffe33d2e6b7fc8030cb54df2144c6a42905374e04dde2972bdfdec6ed7ef22dfb3daf00aea300ced31a6d0392c381c485a1c7af7f23f034eeb6ca731da41677f23ba494dad87ce976d3cea11422af66af66757c69e6d3547661d2868b3ee7a1895134f8e45694d0c44eb2088e193310c4bff0b6faa676f51d614d3afb0846b55e05e226383c01e0e0ad953eb2d1898d45", 0xeb}, {&(0x7f00000003c0)="e2a775bb583c", 0x6}, {&(0x7f0000000400)="1e88f73c7e68800aee74e5639f67decf1f8f319838b653cfe376eb960ede6f515d506f03fa8dd17e230bed95449e94ad0d30c932762fae6ecbfc0577d663950069330b04e671e61d6d13ebed1b827a8509e0f45a84ed7681507d260ffb06768ccd8f02a9fd271167a9b7aca402755e583355f3a08a60f4117a14929b8dde22d5d3610bc0d9fddb90ac838c05eb143011eabf390357b42cb8ab5c00a7993485233f01e46e0d05a9", 0xa7}], 0x3}, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') sendmsg$ETHTOOL_MSG_PAUSE_GET(r5, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x344693109fc324bf, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x9c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:23:37 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:37 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:37 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r1, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:37 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:37 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:37 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:37 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:37 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @multicast2}, 0x1, 0x3, 0x4, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)="84fd2cf5ae8b895c40145344a63f026bff1b033452b26d017caee0e968fab3c39dbe318eae13b3fecc96c93f7e1b291ae2f7091d46e7cceea568b8db14b130f7d1d3eab1ac32b01548cb822aec22d66a2d7326d2fed28ccc1b201ffe33d2e6b7fc8030cb54df2144c6a42905374e04dde2972bdfdec6ed7ef22dfb3daf00aea300ced31a6d0392c381c485a1c7af7f23f034eeb6ca731da41677f23ba494dad87ce976d3cea11422af66af66757c69e6d3547661d2868b3ee7a1895134f8e45694d0c44eb2088e193310c4bff0b6faa676f51d614d3afb0846b55e05e226383c01e0e0ad953eb2d1898d45", 0xeb}, {&(0x7f00000003c0)="e2a775bb583c", 0x6}, {&(0x7f0000000400)="1e88f73c7e68800aee74e5639f67decf1f8f319838b653cfe376eb960ede6f515d506f03fa8dd17e230bed95449e94ad0d30c932762fae6ecbfc0577d663950069330b04e671e61d6d13ebed1b827a8509e0f45a84ed7681507d260ffb06768ccd8f02a9fd271167a9b7aca402755e583355f3a08a60f4117a14929b8dde22d5d3610bc0d9fddb90ac838c05eb143011eabf390357b42cb8ab5c00a7993485233f01e46e0d05a9", 0xa7}], 0x3}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:23:37 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:47 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:47 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:23:47 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @multicast2}, 0x1, 0x3, 0x4, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)="84fd2cf5ae8b895c40145344a63f026bff1b033452b26d017caee0e968fab3c39dbe318eae13b3fecc96c93f7e1b291ae2f7091d46e7cceea568b8db14b130f7d1d3eab1ac32b01548cb822aec22d66a2d7326d2fed28ccc1b201ffe33d2e6b7fc8030cb54df2144c6a42905374e04dde2972bdfdec6ed7ef22dfb3daf00aea300ced31a6d0392c381c485a1c7af7f23f034eeb6ca731da41677f23ba494dad87ce976d3cea11422af66af66757c69e6d3547661d2868b3ee7a1895134f8e45694d0c44eb2088e193310c4bff0b6faa676f51d614d3afb0846b55e05e226383c01e0e0ad953eb2d1898d45", 0xeb}, {&(0x7f00000003c0)="e2a775bb583c", 0x6}, {&(0x7f0000000400)="1e88f73c7e68800aee74e5639f67decf1f8f319838b653cfe376eb960ede6f515d506f03fa8dd17e230bed95449e94ad0d30c932762fae6ecbfc0577d663950069330b04e671e61d6d13ebed1b827a8509e0f45a84ed7681507d260ffb06768ccd8f02a9fd271167a9b7aca402755e583355f3a08a60f4117a14929b8dde22d5d3610bc0d9fddb90ac838c05eb143011eabf390357b42cb8ab5c00a7993485233f01e46e0d05a9", 0xa7}], 0x3}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:23:47 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:47 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r1, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:47 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:47 executing program 6: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:47 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x30, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:48 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:48 executing program 6: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_O_TEI={0x8}, @GTPA_TID={0xc, 0x3, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:48 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:23:48 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:48 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:48 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r1, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_O_TEI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:48 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @multicast2}, 0x1, 0x3, 0x4, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)="84fd2cf5ae8b895c40145344a63f026bff1b033452b26d017caee0e968fab3c39dbe318eae13b3fecc96c93f7e1b291ae2f7091d46e7cceea568b8db14b130f7d1d3eab1ac32b01548cb822aec22d66a2d7326d2fed28ccc1b201ffe33d2e6b7fc8030cb54df2144c6a42905374e04dde2972bdfdec6ed7ef22dfb3daf00aea300ced31a6d0392c381c485a1c7af7f23f034eeb6ca731da41677f23ba494dad87ce976d3cea11422af66af66757c69e6d3547661d2868b3ee7a1895134f8e45694d0c44eb2088e193310c4bff0b6faa676f51d614d3afb0846b55e05e226383c01e0e0ad953eb2d1898d45", 0xeb}, {&(0x7f00000003c0)="e2a775bb583c", 0x6}, {&(0x7f0000000400)="1e88f73c7e68800aee74e5639f67decf1f8f319838b653cfe376eb960ede6f515d506f03fa8dd17e230bed95449e94ad0d30c932762fae6ecbfc0577d663950069330b04e671e61d6d13ebed1b827a8509e0f45a84ed7681507d260ffb06768ccd8f02a9fd271167a9b7aca402755e583355f3a08a60f4117a14929b8dde22d5d3610bc0d9fddb90ac838c05eb143011eabf390357b42cb8ab5c00a7993485233f01e46e0d05a9", 0xa7}], 0x3}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:23:58 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:58 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:58 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, 0x0, 0x4048000) 23:23:58 executing program 6: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:58 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:58 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:23:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:58 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @multicast2}, 0x1, 0x3, 0x4, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)="84fd2cf5ae8b895c40145344a63f026bff1b033452b26d017caee0e968fab3c39dbe318eae13b3fecc96c93f7e1b291ae2f7091d46e7cceea568b8db14b130f7d1d3eab1ac32b01548cb822aec22d66a2d7326d2fed28ccc1b201ffe33d2e6b7fc8030cb54df2144c6a42905374e04dde2972bdfdec6ed7ef22dfb3daf00aea300ced31a6d0392c381c485a1c7af7f23f034eeb6ca731da41677f23ba494dad87ce976d3cea11422af66af66757c69e6d3547661d2868b3ee7a1895134f8e45694d0c44eb2088e193310c4bff0b6faa676f51d614d3afb0846b55e05e226383c01e0e0ad953eb2d1898d45", 0xeb}, {&(0x7f00000003c0)="e2a775bb583c", 0x6}, {&(0x7f0000000400)="1e88f73c7e68800aee74e5639f67decf1f8f319838b653cfe376eb960ede6f515d506f03fa8dd17e230bed95449e94ad0d30c932762fae6ecbfc0577d663950069330b04e671e61d6d13ebed1b827a8509e0f45a84ed7681507d260ffb06768ccd8f02a9fd271167a9b7aca402755e583355f3a08a60f4117a14929b8dde22d5d3610bc0d9fddb90ac838c05eb143011eabf390357b42cb8ab5c00a7993485233f01e46e0d05a9", 0xa7}], 0x3}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:23:58 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:23:58 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:23:58 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x14}, 0x14}}, 0x20000040) 23:23:58 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:23:58 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:23:58 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, 0x0, 0x4048000) 23:24:07 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0x0, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x14}, 0x14}}, 0x0) 23:24:07 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, 0x0, 0x4048000) 23:24:07 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) socketpair(0x2, 0x2, 0x7, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r6}, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r8) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:07 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:07 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:24:07 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:07 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:07 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, 0x0, 0x20000040) 23:24:07 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:07 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:07 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, 0x0, 0x20000040) 23:24:07 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:07 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, 0x0, 0x20000040) 23:24:16 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:16 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:16 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:16 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r4}, 0xc) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r6) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r7, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:24:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:16 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:24:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:16 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) [ 381.219899] kmemleak: Found object by alias at 0x607f1a63e894 [ 381.219920] CPU: 1 UID: 0 PID: 6579 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 381.219938] Tainted: [W]=WARN [ 381.219942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 381.219949] Call Trace: [ 381.219954] [ 381.219959] dump_stack_lvl+0xca/0x120 [ 381.219984] __lookup_object+0x94/0xb0 [ 381.220002] delete_object_full+0x27/0x70 [ 381.220018] free_percpu+0x30/0x1160 [ 381.220035] ? arch_uprobe_clear_state+0x16/0x140 [ 381.220059] futex_hash_free+0x38/0xc0 [ 381.220075] mmput+0x2d3/0x390 [ 381.220094] do_exit+0x79d/0x2970 [ 381.220108] ? lock_release+0xc8/0x290 [ 381.220125] ? __pfx_do_exit+0x10/0x10 [ 381.220140] ? find_held_lock+0x2b/0x80 [ 381.220157] ? get_signal+0x835/0x2340 [ 381.220178] do_group_exit+0xd3/0x2a0 [ 381.220193] get_signal+0x2315/0x2340 [ 381.220211] ? __fget_files+0x203/0x3b0 [ 381.220227] ? __pfx_get_signal+0x10/0x10 [ 381.220243] ? do_futex+0x135/0x370 [ 381.220257] ? __pfx_do_futex+0x10/0x10 [ 381.220273] arch_do_signal_or_restart+0x80/0x790 [ 381.220294] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 381.220311] ? __x64_sys_futex+0x1c9/0x4d0 [ 381.220324] ? __x64_sys_futex+0x1d2/0x4d0 [ 381.220339] ? __pfx___x64_sys_futex+0x10/0x10 [ 381.220358] exit_to_user_mode_loop+0x8b/0x110 [ 381.220371] do_syscall_64+0x2f7/0x360 [ 381.220384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.220397] RIP: 0033:0x7f5141970b19 [ 381.220406] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 381.220411] RSP: 002b:00007f513eec5218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 381.220423] RAX: fffffffffffffe00 RBX: 00007f5141a84028 RCX: 00007f5141970b19 [ 381.220431] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a84028 [ 381.220438] RBP: 00007f5141a84020 R08: 0000000000000000 R09: 0000000000000000 [ 381.220445] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a8402c [ 381.220452] R13: 00007ffef881168f R14: 00007f513eec5300 R15: 0000000000022000 [ 381.220468] [ 381.220472] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 381.220478] kmemleak: comm "syz-executor.6", pid 6585, jiffies 4295048138 [ 381.220486] kmemleak: min_count = 1 [ 381.220490] kmemleak: count = 0 [ 381.220493] kmemleak: flags = 0x21 [ 381.220497] kmemleak: checksum = 0 [ 381.220501] kmemleak: backtrace: [ 381.220504] pcpu_alloc_noprof+0x87a/0x1170 [ 381.220520] percpu_ref_init+0x37/0x400 [ 381.220531] io_uring_setup+0x44c/0x2000 [ 381.220542] __x64_sys_io_uring_setup+0xc8/0x170 [ 381.220554] do_syscall_64+0xbf/0x360 [ 381.220564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.416965] kmemleak: Found object by alias at 0x607f1a63e26c [ 381.416988] CPU: 1 UID: 0 PID: 6588 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 381.417007] Tainted: [W]=WARN [ 381.417010] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 381.417018] Call Trace: [ 381.417022] [ 381.417027] dump_stack_lvl+0xca/0x120 [ 381.417053] __lookup_object+0x94/0xb0 [ 381.417071] delete_object_full+0x27/0x70 [ 381.417088] free_percpu+0x30/0x1160 [ 381.417105] ? arch_uprobe_clear_state+0x16/0x140 [ 381.417130] futex_hash_free+0x38/0xc0 [ 381.417144] mmput+0x2d3/0x390 [ 381.417163] do_exit+0x79d/0x2970 [ 381.417177] ? lock_release+0xc8/0x290 [ 381.417194] ? __pfx_do_exit+0x10/0x10 [ 381.417208] ? find_held_lock+0x2b/0x80 [ 381.417226] ? get_signal+0x835/0x2340 [ 381.417246] do_group_exit+0xd3/0x2a0 [ 381.417262] get_signal+0x2315/0x2340 [ 381.417282] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 381.417298] ? __pfx_get_signal+0x10/0x10 [ 381.417315] ? do_futex+0x135/0x370 [ 381.417328] ? __pfx_do_futex+0x10/0x10 [ 381.417344] arch_do_signal_or_restart+0x80/0x790 [ 381.417362] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 381.417378] ? __x64_sys_futex+0x1c9/0x4d0 [ 381.417391] ? __x64_sys_futex+0x1d2/0x4d0 [ 381.417405] ? fput_close_sync+0x114/0x240 [ 381.417421] ? __pfx___x64_sys_futex+0x10/0x10 [ 381.417434] ? __pfx_fput_close_sync+0x10/0x10 [ 381.417450] ? dnotify_flush+0x79/0x4c0 [ 381.417466] exit_to_user_mode_loop+0x8b/0x110 [ 381.417479] do_syscall_64+0x2f7/0x360 [ 381.417492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.417504] RIP: 0033:0x7fcf751aeb19 [ 381.417513] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 381.417518] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 381.417530] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 381.417538] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 381.417545] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 381.417552] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 381.417559] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 381.417574] [ 381.417578] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 381.417585] kmemleak: comm "syz-executor.2", pid 6596, jiffies 4295048328 [ 381.417592] kmemleak: min_count = 1 [ 381.417596] kmemleak: count = 0 [ 381.417599] kmemleak: flags = 0x21 [ 381.417603] kmemleak: checksum = 0 [ 381.417607] kmemleak: backtrace: [ 381.417610] pcpu_alloc_noprof+0x87a/0x1170 [ 381.417626] percpu_ref_init+0x37/0x400 [ 381.417636] io_uring_setup+0x44c/0x2000 [ 381.417649] __x64_sys_io_uring_setup+0xc8/0x170 [ 381.417660] do_syscall_64+0xbf/0x360 [ 381.417670] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:24:24 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:24 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:24:24 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 23:24:24 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', r2, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r4}, 0xc) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r6) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r7, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:24 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40), 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:24 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x0, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:24 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:24 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, 0x0, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}}, 0x20000040) 23:24:25 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40), 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, 0x0, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}}, 0x0) 23:24:25 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:24:25 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, 0x0, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:25 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 389.871285] kmemleak: Found object by alias at 0x607f1a63e26c [ 389.871308] CPU: 1 UID: 0 PID: 6605 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 389.871327] Tainted: [W]=WARN [ 389.871330] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 389.871338] Call Trace: [ 389.871342] [ 389.871347] dump_stack_lvl+0xca/0x120 [ 389.871374] __lookup_object+0x94/0xb0 [ 389.871391] delete_object_full+0x27/0x70 [ 389.871408] free_percpu+0x30/0x1160 [ 389.871425] ? arch_uprobe_clear_state+0x16/0x140 [ 389.871446] futex_hash_free+0x38/0xc0 [ 389.871460] mmput+0x2d3/0x390 [ 389.871480] do_exit+0x79d/0x2970 [ 389.871494] ? signal_wake_up_state+0x85/0x120 [ 389.871510] ? zap_other_threads+0x2b9/0x3a0 [ 389.871526] ? __pfx_do_exit+0x10/0x10 [ 389.871539] ? do_group_exit+0x1c3/0x2a0 [ 389.871553] ? lock_release+0xc8/0x290 [ 389.871570] do_group_exit+0xd3/0x2a0 [ 389.871589] __x64_sys_exit_group+0x3e/0x50 [ 389.871604] x64_sys_call+0x18c5/0x18d0 [ 389.871619] do_syscall_64+0xbf/0x360 [ 389.871632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.871644] RIP: 0033:0x7fcf751aeb19 [ 389.871653] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 389.871658] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 389.871670] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 389.871677] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 389.871685] RBP: 0000000000000000 R08: 0000001b2d022288 R09: 0000000000000000 [ 389.871691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 389.871698] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 389.871713] [ 389.871717] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 389.871724] kmemleak: comm "syz-executor.6", pid 6651, jiffies 4295056789 [ 389.871731] kmemleak: min_count = 1 [ 389.871735] kmemleak: count = 0 [ 389.871739] kmemleak: flags = 0x21 [ 389.871742] kmemleak: checksum = 0 [ 389.871746] kmemleak: backtrace: [ 389.871750] pcpu_alloc_noprof+0x87a/0x1170 [ 389.871765] percpu_ref_init+0x37/0x400 [ 389.871776] io_uring_setup+0x44c/0x2000 [ 389.871788] __x64_sys_io_uring_setup+0xc8/0x170 [ 389.871800] do_syscall_64+0xbf/0x360 [ 389.871809] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:24:33 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:33 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:33 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001600)={'erspan0\x00', &(0x7f0000001580)={'erspan0\x00', r2, 0x80, 0x780, 0x1, 0x1, {{0x18, 0x4, 0x0, 0x9, 0x60, 0x68, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010102, @multicast2, {[@generic={0x83, 0x2}, @cipso={0x86, 0x46, 0xffffffffffffffff, [{0xf, 0xa, "e95e8f9747693a34"}, {0x7, 0x3, "ce"}, {0x6, 0xe, "83072c36d6ea5dcfe1f471c3"}, {0x0, 0x8, "b5a49a31b674"}, {0x1, 0xa, "072e4e3e6a47982d"}, {0x5, 0xc, "bb2a9b2b788e26f883c4"}, {0x6, 0x7, "4887921aea"}]}, @end]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:33 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:33 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x0, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:33 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r3}, 0xc) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r5) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:33 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40), 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:33 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:33 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:33 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:33 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:33 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:33 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:33 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:33 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:24:33 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x0, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:33 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r3}, 0xc) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r5) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:42 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:42 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x1, 0x0, 0x25dfdbfe, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:42 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:42 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:24:42 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:42 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:42 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4048000) [ 407.051127] kmemleak: Found object by alias at 0x607f1a63e894 [ 407.051147] CPU: 1 UID: 0 PID: 6749 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 407.051166] Tainted: [W]=WARN [ 407.051169] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 407.051177] Call Trace: [ 407.051181] [ 407.051186] dump_stack_lvl+0xca/0x120 [ 407.051212] __lookup_object+0x94/0xb0 [ 407.051229] delete_object_full+0x27/0x70 [ 407.051246] free_percpu+0x30/0x1160 [ 407.051263] ? arch_uprobe_clear_state+0x16/0x140 [ 407.051284] futex_hash_free+0x38/0xc0 [ 407.051298] mmput+0x2d3/0x390 [ 407.051318] do_exit+0x79d/0x2970 [ 407.051332] ? signal_wake_up_state+0x85/0x120 [ 407.051348] ? zap_other_threads+0x2b9/0x3a0 [ 407.051364] ? __pfx_do_exit+0x10/0x10 [ 407.051377] ? do_group_exit+0x1c3/0x2a0 [ 407.051391] ? lock_release+0xc8/0x290 [ 407.051408] do_group_exit+0xd3/0x2a0 [ 407.051423] __x64_sys_exit_group+0x3e/0x50 [ 407.051437] x64_sys_call+0x18c5/0x18d0 [ 407.051453] do_syscall_64+0xbf/0x360 [ 407.051466] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.051477] RIP: 0033:0x7f5141970b19 [ 407.051486] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 407.051491] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 407.051503] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 407.051511] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 407.051518] RBP: 0000000000000000 R08: 0000001b2d122764 R09: 0000000000000000 [ 407.051525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.051531] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 407.051547] [ 407.051550] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 407.051557] kmemleak: comm "syz-executor.6", pid 6758, jiffies 4295073941 [ 407.051564] kmemleak: min_count = 1 [ 407.051568] kmemleak: count = 0 [ 407.051572] kmemleak: flags = 0x21 [ 407.051576] kmemleak: checksum = 0 [ 407.051579] kmemleak: backtrace: [ 407.051584] pcpu_alloc_noprof+0x87a/0x1170 [ 407.051604] percpu_ref_init+0x37/0x400 [ 407.051615] io_uring_setup+0x44c/0x2000 [ 407.051627] __x64_sys_io_uring_setup+0xc8/0x170 [ 407.051639] do_syscall_64+0xbf/0x360 [ 407.051648] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:24:42 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={0x0}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:42 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:42 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:42 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:42 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:42 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:42 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={0x0}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', r1, 0x4, 0x1f, 0x3f, 0x9, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x80, 0x1, 0x4}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r3}, 0xc) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r5) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r6, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:42 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:42 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:52 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r2}, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r4) sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:24:52 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:24:52 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:52 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) 23:24:52 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={0x0}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:24:52 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001540)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:24:52 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:24:52 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:24:52 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) [ 417.557541] kmemleak: Found object by alias at 0x607f1a63e894 [ 417.557566] CPU: 1 UID: 0 PID: 6823 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 417.557585] Tainted: [W]=WARN [ 417.557593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 417.557600] Call Trace: [ 417.557604] [ 417.557610] dump_stack_lvl+0xca/0x120 [ 417.557636] __lookup_object+0x94/0xb0 [ 417.557654] delete_object_full+0x27/0x70 [ 417.557670] free_percpu+0x30/0x1160 [ 417.557688] ? arch_uprobe_clear_state+0x16/0x140 [ 417.557707] futex_hash_free+0x38/0xc0 [ 417.557722] mmput+0x2d3/0x390 [ 417.557741] do_exit+0x79d/0x2970 [ 417.557759] ? __pfx_do_exit+0x10/0x10 [ 417.557773] ? find_held_lock+0x2b/0x80 [ 417.557791] ? get_signal+0x835/0x2340 [ 417.557812] do_group_exit+0xd3/0x2a0 [ 417.557827] get_signal+0x2315/0x2340 [ 417.557845] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 417.557862] ? __pfx_get_signal+0x10/0x10 [ 417.557878] ? __schedule+0xe91/0x3590 [ 417.557900] arch_do_signal_or_restart+0x80/0x790 [ 417.557918] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 417.557934] ? __x64_sys_futex+0x1c9/0x4d0 [ 417.557947] ? __x64_sys_futex+0x1d2/0x4d0 [ 417.557962] ? __pfx___x64_sys_futex+0x10/0x10 [ 417.557981] exit_to_user_mode_loop+0x8b/0x110 [ 417.557994] do_syscall_64+0x2f7/0x360 [ 417.558007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.558019] RIP: 0033:0x7f5141970b19 [ 417.558028] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 417.558033] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 417.558045] RAX: 0000000000000001 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 417.558053] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5141a83f6c [ 417.558060] RBP: 00007f5141a83f60 R08: 000000000000003d R09: 0000000000000000 [ 417.558067] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f5141a83f6c [ 417.558074] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 417.558090] [ 417.558094] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 417.558100] kmemleak: comm "syz-executor.6", pid 6831, jiffies 4295084469 [ 417.558107] kmemleak: min_count = 1 [ 417.558111] kmemleak: count = 0 [ 417.558115] kmemleak: flags = 0x21 [ 417.558119] kmemleak: checksum = 0 [ 417.558122] kmemleak: backtrace: [ 417.558126] pcpu_alloc_noprof+0x87a/0x1170 [ 417.558141] percpu_ref_init+0x37/0x400 [ 417.558152] io_uring_setup+0x44c/0x2000 [ 417.558164] __x64_sys_io_uring_setup+0xc8/0x170 [ 417.558176] do_syscall_64+0xbf/0x360 [ 417.558185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.567633] kmemleak: Found object by alias at 0x607f1a63e26c [ 417.567666] CPU: 0 UID: 0 PID: 6819 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 417.567709] Tainted: [W]=WARN [ 417.567717] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 417.567730] Call Trace: [ 417.567738] [ 417.567747] dump_stack_lvl+0xca/0x120 [ 417.567792] __lookup_object+0x94/0xb0 [ 417.567825] delete_object_full+0x27/0x70 [ 417.567858] free_percpu+0x30/0x1160 [ 417.567891] ? arch_uprobe_clear_state+0x16/0x140 [ 417.567931] futex_hash_free+0x38/0xc0 [ 417.567959] mmput+0x2d3/0x390 [ 417.567996] do_exit+0x79d/0x2970 [ 417.568024] ? signal_wake_up_state+0x85/0x120 [ 417.568056] ? zap_other_threads+0x2b9/0x3a0 [ 417.568088] ? __pfx_do_exit+0x10/0x10 [ 417.568114] ? do_group_exit+0x1c3/0x2a0 [ 417.568142] ? lock_release+0xc8/0x290 [ 417.568175] do_group_exit+0xd3/0x2a0 [ 417.568205] __x64_sys_exit_group+0x3e/0x50 [ 417.568234] x64_sys_call+0x18c5/0x18d0 [ 417.568265] do_syscall_64+0xbf/0x360 [ 417.568290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.568313] RIP: 0033:0x7fcf751aeb19 [ 417.568331] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 417.568341] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 417.568364] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 417.568379] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 417.568393] RBP: 0000000000000000 R08: 0000001b2d022e58 R09: 0000000000000000 [ 417.568407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 417.568421] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 417.568451] [ 417.568459] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 417.568472] kmemleak: comm "syz-executor.6", pid 6831, jiffies 4295084448 [ 417.568486] kmemleak: min_count = 1 [ 417.568494] kmemleak: count = 0 [ 417.568501] kmemleak: flags = 0x21 [ 417.568509] kmemleak: checksum = 0 [ 417.568516] kmemleak: backtrace: [ 417.568522] pcpu_alloc_noprof+0x87a/0x1170 [ 417.568553] percpu_ref_init+0x37/0x400 [ 417.568574] io_uring_setup+0x44c/0x2000 [ 417.568597] __x64_sys_io_uring_setup+0xc8/0x170 [ 417.568621] do_syscall_64+0xbf/0x360 [ 417.568639] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:24:53 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x800}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:24:53 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:01 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:01 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x0, 0x0, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:01 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r2}, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r4) sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:01 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:01 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:25:01 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:01 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:01 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:25:01 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) 23:25:01 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:01 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:01 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:25:01 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x3c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}]}, 0x3c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:01 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:01 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x0, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:01 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) 23:25:09 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:09 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:09 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) 23:25:09 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:09 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:25:09 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}]}, 0x34}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:09 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:09 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x0, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:09 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:09 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) [ 434.586800] kmemleak: Found object by alias at 0x607f1a63e26c [ 434.586833] CPU: 0 UID: 0 PID: 6939 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 434.586867] Tainted: [W]=WARN [ 434.586874] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 434.586887] Call Trace: [ 434.586894] [ 434.586903] dump_stack_lvl+0xca/0x120 [ 434.586952] __lookup_object+0x94/0xb0 [ 434.586983] delete_object_full+0x27/0x70 [ 434.587014] free_percpu+0x30/0x1160 [ 434.587045] ? arch_uprobe_clear_state+0x16/0x140 [ 434.587082] futex_hash_free+0x38/0xc0 [ 434.587108] mmput+0x2d3/0x390 [ 434.587143] do_exit+0x79d/0x2970 [ 434.587176] ? __pfx_do_exit+0x10/0x10 [ 434.587202] ? find_held_lock+0x2b/0x80 [ 434.587236] ? get_signal+0x835/0x2340 [ 434.587273] do_group_exit+0xd3/0x2a0 [ 434.587312] get_signal+0x2315/0x2340 [ 434.587346] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 434.587377] ? __pfx_get_signal+0x10/0x10 [ 434.587409] ? __schedule+0xe91/0x3590 [ 434.587453] arch_do_signal_or_restart+0x80/0x790 [ 434.587486] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 434.587517] ? __x64_sys_futex+0x1c9/0x4d0 [ 434.587541] ? __x64_sys_futex+0x1d2/0x4d0 [ 434.587569] ? __pfx___x64_sys_futex+0x10/0x10 [ 434.587604] exit_to_user_mode_loop+0x8b/0x110 [ 434.587628] do_syscall_64+0x2f7/0x360 [ 434.587652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.587674] RIP: 0033:0x7fcf751aeb19 [ 434.587690] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 434.587700] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 434.587722] RAX: 0000000000000001 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 434.587736] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fcf752c1f6c [ 434.587749] RBP: 00007fcf752c1f60 R08: 000000000000000e R09: 0000000000000000 [ 434.587762] R10: 0000000000000024 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 434.587776] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 434.587804] [ 434.587812] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 434.587824] kmemleak: comm "syz-executor.6", pid 6948, jiffies 4295101452 [ 434.587837] kmemleak: min_count = 1 [ 434.587845] kmemleak: count = 0 [ 434.587852] kmemleak: flags = 0x21 [ 434.587859] kmemleak: checksum = 0 [ 434.587866] kmemleak: backtrace: [ 434.587872] pcpu_alloc_noprof+0x87a/0x1170 [ 434.587901] percpu_ref_init+0x37/0x400 [ 434.587920] io_uring_setup+0x44c/0x2000 [ 434.587942] __x64_sys_io_uring_setup+0xc8/0x170 [ 434.587963] do_syscall_64+0xbf/0x360 [ 434.587981] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:25:10 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:10 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:25:10 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) 23:25:10 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:10 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x0, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:10 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:19 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:19 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}]}, 0x1c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:19 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x0, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:19 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:19 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, 0x0, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:25:19 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:19 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) 23:25:19 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) 23:25:19 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:19 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:19 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:20 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x14, 0x0, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x850) 23:25:20 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:20 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:20 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:20 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x24004010) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:20 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:20 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:20 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:25:30 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:30 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x38, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:30 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:30 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:25:30 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x14, 0x0, 0x1}, 0x14}}, 0x850) 23:25:30 executing program 3: getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:30 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:30 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:30 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:25:30 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:30 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:30 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:30 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x30, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:40 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:40 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001200)={'ip6_vti0\x00', &(0x7f0000001180)={'sit0\x00', r2, 0x2f, 0x0, 0x4, 0x1, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @loopback, 0x10, 0x80, 0x9e, 0x1c6}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:40 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:40 executing program 3: getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:40 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:40 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:40 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:40 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x14, 0x0, 0x1}, 0x14}}, 0x0) 23:25:40 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x14, 0x0, 0x1}, 0x14}}, 0x0) 23:25:40 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:41 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:41 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:41 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:41 executing program 4: syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x14, 0x0, 0x1}, 0x14}}, 0x0) 23:25:41 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:41 executing program 3: getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:41 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) 23:25:41 executing program 0: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:49 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:49 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:49 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:49 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:49 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) 23:25:49 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:49 executing program 0: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:49 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) [ 474.390234] kmemleak: Found object by alias at 0x607f1a63e26c [ 474.390255] CPU: 1 UID: 0 PID: 7232 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 474.390274] Tainted: [W]=WARN [ 474.390277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 474.390285] Call Trace: [ 474.390289] [ 474.390295] dump_stack_lvl+0xca/0x120 [ 474.390321] __lookup_object+0x94/0xb0 [ 474.390344] delete_object_full+0x27/0x70 [ 474.390361] free_percpu+0x30/0x1160 [ 474.390378] ? arch_uprobe_clear_state+0x16/0x140 [ 474.390399] futex_hash_free+0x38/0xc0 [ 474.390413] mmput+0x2d3/0x390 [ 474.390432] do_exit+0x79d/0x2970 [ 474.390450] ? __pfx_do_exit+0x10/0x10 [ 474.390465] ? find_held_lock+0x2b/0x80 [ 474.390483] ? get_signal+0x835/0x2340 [ 474.390504] do_group_exit+0xd3/0x2a0 [ 474.390519] get_signal+0x2315/0x2340 [ 474.390537] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 474.390554] ? __pfx_get_signal+0x10/0x10 [ 474.390571] ? __schedule+0xe91/0x3590 [ 474.390592] arch_do_signal_or_restart+0x80/0x790 [ 474.390610] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 474.390627] ? __x64_sys_futex+0x1c9/0x4d0 [ 474.390640] ? __x64_sys_futex+0x1d2/0x4d0 [ 474.390655] ? __pfx___x64_sys_futex+0x10/0x10 [ 474.390669] ? ksys_mmap_pgoff+0x85/0x520 [ 474.390689] exit_to_user_mode_loop+0x8b/0x110 [ 474.390702] do_syscall_64+0x2f7/0x360 [ 474.390715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.390727] RIP: 0033:0x7fcf751aeb19 [ 474.390737] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 474.390742] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 474.390754] RAX: 0000000000000001 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 474.390761] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fcf752c1f6c [ 474.390768] RBP: 00007fcf752c1f60 R08: 0000000000000016 R09: 0000000000000000 [ 474.390776] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fcf752c1f6c [ 474.390783] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 474.390798] [ 474.390802] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 474.390809] kmemleak: comm "syz-executor.6", pid 7231, jiffies 4295141301 [ 474.390816] kmemleak: min_count = 1 [ 474.390820] kmemleak: count = 0 [ 474.390823] kmemleak: flags = 0x21 [ 474.390827] kmemleak: checksum = 0 [ 474.390831] kmemleak: backtrace: [ 474.390834] pcpu_alloc_noprof+0x87a/0x1170 [ 474.390850] percpu_ref_init+0x37/0x400 [ 474.390861] io_uring_setup+0x44c/0x2000 [ 474.390873] __x64_sys_io_uring_setup+0xc8/0x170 [ 474.390884] do_syscall_64+0xbf/0x360 [ 474.390894] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:25:49 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:49 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:49 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) 23:25:49 executing program 0: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:49 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:50 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 474.637911] kmemleak: Found object by alias at 0x607f1a63e26c [ 474.637934] CPU: 1 UID: 0 PID: 7255 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 474.637953] Tainted: [W]=WARN [ 474.637957] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 474.637964] Call Trace: [ 474.637968] [ 474.637973] dump_stack_lvl+0xca/0x120 [ 474.637999] __lookup_object+0x94/0xb0 [ 474.638017] delete_object_full+0x27/0x70 [ 474.638033] free_percpu+0x30/0x1160 [ 474.638050] ? arch_uprobe_clear_state+0x16/0x140 [ 474.638071] futex_hash_free+0x38/0xc0 [ 474.638086] mmput+0x2d3/0x390 [ 474.638105] do_exit+0x79d/0x2970 [ 474.638119] ? signal_wake_up_state+0x85/0x120 [ 474.638138] ? zap_other_threads+0x2b9/0x3a0 [ 474.638157] ? __pfx_do_exit+0x10/0x10 [ 474.638170] ? do_group_exit+0x1c3/0x2a0 [ 474.638184] ? lock_release+0xc8/0x290 [ 474.638201] do_group_exit+0xd3/0x2a0 [ 474.638216] __x64_sys_exit_group+0x3e/0x50 [ 474.638230] x64_sys_call+0x18c5/0x18d0 [ 474.638247] do_syscall_64+0xbf/0x360 [ 474.638259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.638271] RIP: 0033:0x7fcf751aeb19 [ 474.638280] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 474.638285] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 474.638297] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 474.638305] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 474.638312] RBP: 0000000000000000 R08: 0000001b2d023d10 R09: 0000000000000000 [ 474.638319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 474.638326] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 474.638341] [ 474.638345] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 474.638352] kmemleak: comm "syz-executor.2", pid 7265, jiffies 4295141544 [ 474.638359] kmemleak: min_count = 1 [ 474.638363] kmemleak: count = 0 [ 474.638367] kmemleak: flags = 0x21 [ 474.638370] kmemleak: checksum = 0 [ 474.638374] kmemleak: backtrace: [ 474.638377] pcpu_alloc_noprof+0x87a/0x1170 [ 474.638393] percpu_ref_init+0x37/0x400 [ 474.638404] io_uring_setup+0x44c/0x2000 [ 474.638417] __x64_sys_io_uring_setup+0xc8/0x170 [ 474.638428] do_syscall_64+0xbf/0x360 [ 474.638438] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:25:50 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:50 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:58 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip6gre0\x00', r1, 0x2f, 0x0, 0x33, 0x5e8, 0x12, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0x1}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:25:58 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:25:58 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:25:58 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:25:58 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:58 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4048000) 23:25:58 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:25:58 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 23:25:58 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 23:25:58 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) [ 483.347071] kmemleak: Found object by alias at 0x607f1a63e894 [ 483.347092] CPU: 1 UID: 0 PID: 7291 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 483.347111] Tainted: [W]=WARN [ 483.347115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 483.347122] Call Trace: [ 483.347126] [ 483.347131] dump_stack_lvl+0xca/0x120 [ 483.347156] __lookup_object+0x94/0xb0 [ 483.347174] delete_object_full+0x27/0x70 [ 483.347190] free_percpu+0x30/0x1160 [ 483.347208] ? arch_uprobe_clear_state+0x16/0x140 [ 483.347229] futex_hash_free+0x38/0xc0 [ 483.347243] mmput+0x2d3/0x390 [ 483.347262] do_exit+0x79d/0x2970 [ 483.347276] ? signal_wake_up_state+0x85/0x120 [ 483.347293] ? zap_other_threads+0x2b9/0x3a0 [ 483.347309] ? __pfx_do_exit+0x10/0x10 [ 483.347322] ? do_group_exit+0x1c3/0x2a0 [ 483.347336] ? lock_release+0xc8/0x290 [ 483.347352] do_group_exit+0xd3/0x2a0 [ 483.347368] __x64_sys_exit_group+0x3e/0x50 [ 483.347382] x64_sys_call+0x18c5/0x18d0 [ 483.347397] do_syscall_64+0xbf/0x360 [ 483.347410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.347422] RIP: 0033:0x7f5141970b19 [ 483.347431] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 483.347436] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 483.347448] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 483.347456] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 483.347463] RBP: 0000000000000000 R08: 0000001b2d121200 R09: 0000000000000000 [ 483.347470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.347477] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 483.347492] [ 483.347496] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 483.347503] kmemleak: comm "syz-executor.6", pid 7304, jiffies 4295150244 [ 483.347510] kmemleak: min_count = 1 [ 483.347514] kmemleak: count = 0 [ 483.347517] kmemleak: flags = 0x21 [ 483.347521] kmemleak: checksum = 0 [ 483.347525] kmemleak: backtrace: [ 483.347529] pcpu_alloc_noprof+0x87a/0x1170 [ 483.347544] percpu_ref_init+0x37/0x400 [ 483.347555] io_uring_setup+0x44c/0x2000 [ 483.347567] __x64_sys_io_uring_setup+0xc8/0x170 [ 483.347579] do_syscall_64+0xbf/0x360 [ 483.347593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.358752] kmemleak: Found object by alias at 0x607f1a63e26c [ 483.358785] CPU: 0 UID: 0 PID: 7297 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 483.358819] Tainted: [W]=WARN [ 483.358826] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 483.358839] Call Trace: [ 483.358846] [ 483.358855] dump_stack_lvl+0xca/0x120 [ 483.358898] __lookup_object+0x94/0xb0 [ 483.358929] delete_object_full+0x27/0x70 [ 483.358960] free_percpu+0x30/0x1160 [ 483.358990] ? arch_uprobe_clear_state+0x16/0x140 [ 483.359027] futex_hash_free+0x38/0xc0 [ 483.359054] mmput+0x2d3/0x390 [ 483.359088] do_exit+0x79d/0x2970 [ 483.359114] ? lock_release+0xc8/0x290 [ 483.359145] ? __pfx_do_exit+0x10/0x10 [ 483.359171] ? find_held_lock+0x2b/0x80 [ 483.359203] ? get_signal+0x835/0x2340 [ 483.359241] do_group_exit+0xd3/0x2a0 [ 483.359269] get_signal+0x2315/0x2340 [ 483.359303] ? lock_release+0xc8/0x290 [ 483.359334] ? __pfx_get_signal+0x10/0x10 [ 483.359365] ? do_futex+0x135/0x370 [ 483.359391] ? __pfx_do_futex+0x10/0x10 [ 483.359419] arch_do_signal_or_restart+0x80/0x790 [ 483.359452] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 483.359483] ? __x64_sys_futex+0x1c9/0x4d0 [ 483.359507] ? __x64_sys_futex+0x1d2/0x4d0 [ 483.359535] ? __pfx___x64_sys_futex+0x10/0x10 [ 483.359561] ? ksys_mmap_pgoff+0x85/0x520 [ 483.359604] exit_to_user_mode_loop+0x8b/0x110 [ 483.359628] do_syscall_64+0x2f7/0x360 [ 483.359652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.359674] RIP: 0033:0x7fcf751aeb19 [ 483.359690] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 483.359699] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 483.359721] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 483.359735] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 483.359748] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 483.359761] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 483.359774] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 483.359803] [ 483.359810] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 483.359823] kmemleak: comm "syz-executor.6", pid 7304, jiffies 4295150215 [ 483.359836] kmemleak: min_count = 1 [ 483.359843] kmemleak: count = 0 [ 483.359850] kmemleak: flags = 0x21 [ 483.359857] kmemleak: checksum = 0 [ 483.359864] kmemleak: backtrace: [ 483.359870] pcpu_alloc_noprof+0x87a/0x1170 [ 483.359909] percpu_ref_init+0x37/0x400 [ 483.359928] io_uring_setup+0x44c/0x2000 [ 483.359950] __x64_sys_io_uring_setup+0xc8/0x170 [ 483.359972] do_syscall_64+0xbf/0x360 [ 483.359990] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:25:58 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:25:58 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 23:26:08 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @broadcast, @dev}, &(0x7f0000000040)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:08 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:08 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:08 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:08 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 23:26:08 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x14}, 0x14}}, 0x4048000) 23:26:08 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') 23:26:08 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:08 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:08 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:08 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') 23:26:08 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:08 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:08 executing program 7: syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x14}, 0x14}}, 0x0) 23:26:09 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:09 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000040)) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:09 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:09 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:09 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:09 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) getrandom(&(0x7f00000000c0)=""/4096, 0x1000, 0x1) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:09 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') 23:26:09 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:09 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x7, 0x8, 0x40, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}, @local, 0x700, 0x8000, 0x8000, 0x9}}) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', r1, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:19 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={0x0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:19 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:19 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:19 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:19 executing program 4: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:26:19 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:19 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:19 executing program 0: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) 23:26:19 executing program 4: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:26:19 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={0x0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:29 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:29 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={0x0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:29 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:29 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:29 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:29 executing program 0: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) 23:26:29 executing program 4: r0 = syz_open_procfs(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) 23:26:29 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x20, 0x7, 0x8, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, 0x40, 0x10, 0x80000000, 0x20}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) [ 513.832081] kmemleak: Found object by alias at 0x607f1a63e26c [ 513.832112] CPU: 1 UID: 0 PID: 7465 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 513.832144] Tainted: [W]=WARN [ 513.832151] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 513.832163] Call Trace: [ 513.832170] [ 513.832178] dump_stack_lvl+0xca/0x120 [ 513.832219] __lookup_object+0x94/0xb0 [ 513.832248] delete_object_full+0x27/0x70 [ 513.832277] free_percpu+0x30/0x1160 [ 513.832321] ? arch_uprobe_clear_state+0x16/0x140 [ 513.832355] futex_hash_free+0x38/0xc0 [ 513.832380] mmput+0x2d3/0x390 [ 513.832413] do_exit+0x79d/0x2970 [ 513.832437] ? signal_wake_up_state+0x85/0x120 [ 513.832464] ? zap_other_threads+0x2b9/0x3a0 [ 513.832492] ? __pfx_do_exit+0x10/0x10 [ 513.832515] ? do_group_exit+0x1c3/0x2a0 [ 513.832540] ? lock_release+0xc8/0x290 [ 513.832569] do_group_exit+0xd3/0x2a0 [ 513.832602] __x64_sys_exit_group+0x3e/0x50 [ 513.832627] x64_sys_call+0x18c5/0x18d0 [ 513.832654] do_syscall_64+0xbf/0x360 [ 513.832676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.832696] RIP: 0033:0x7fcf751aeb19 [ 513.832712] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 513.832721] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 513.832741] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 513.832754] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 513.832767] RBP: 0000000000000000 R08: 0000001b2d021350 R09: 0000000000000000 [ 513.832779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 513.832791] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 513.832817] [ 513.832824] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 513.832836] kmemleak: comm "syz-executor.6", pid 7474, jiffies 4295180747 [ 513.832848] kmemleak: min_count = 1 [ 513.832855] kmemleak: count = 0 [ 513.832861] kmemleak: flags = 0x21 [ 513.832868] kmemleak: checksum = 0 [ 513.832875] kmemleak: backtrace: [ 513.832880] pcpu_alloc_noprof+0x87a/0x1170 [ 513.832908] percpu_ref_init+0x37/0x400 [ 513.832926] io_uring_setup+0x44c/0x2000 [ 513.832946] __x64_sys_io_uring_setup+0xc8/0x170 [ 513.832966] do_syscall_64+0xbf/0x360 [ 513.832983] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:26:29 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:29 executing program 0: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) 23:26:29 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 23:26:29 executing program 2: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:29 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:29 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:29 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:29 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:38 executing program 2: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:38 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='net/ip6_mr_vif\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:38 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:38 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:38 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:38 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:26:38 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 23:26:38 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) [ 522.860375] kmemleak: Found object by alias at 0x607f1a63e26c [ 522.860397] CPU: 1 UID: 0 PID: 7522 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 522.860427] Tainted: [W]=WARN [ 522.860430] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 522.860438] Call Trace: [ 522.860442] [ 522.860447] dump_stack_lvl+0xca/0x120 [ 522.860479] __lookup_object+0x94/0xb0 [ 522.860497] delete_object_full+0x27/0x70 [ 522.860514] free_percpu+0x30/0x1160 [ 522.860532] ? arch_uprobe_clear_state+0x16/0x140 [ 522.860553] futex_hash_free+0x38/0xc0 [ 522.860568] mmput+0x2d3/0x390 [ 522.860591] do_exit+0x79d/0x2970 [ 522.860605] ? signal_wake_up_state+0x85/0x120 [ 522.860622] ? zap_other_threads+0x2b9/0x3a0 [ 522.860638] ? __pfx_do_exit+0x10/0x10 [ 522.860651] ? do_group_exit+0x1c3/0x2a0 [ 522.860665] ? lock_release+0xc8/0x290 [ 522.860683] do_group_exit+0xd3/0x2a0 [ 522.860698] __x64_sys_exit_group+0x3e/0x50 [ 522.860712] x64_sys_call+0x18c5/0x18d0 [ 522.860729] do_syscall_64+0xbf/0x360 [ 522.860742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.860754] RIP: 0033:0x7fcf751aeb19 [ 522.860763] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 522.860769] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 522.860781] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 522.860789] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 522.860796] RBP: 0000000000000000 R08: 0000001b2d021fc8 R09: 0000000000000000 [ 522.860804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.860811] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 522.860826] [ 522.860830] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 522.860837] kmemleak: comm "syz-executor.6", pid 7534, jiffies 4295189780 [ 522.860845] kmemleak: min_count = 1 [ 522.860849] kmemleak: count = 0 [ 522.860852] kmemleak: flags = 0x21 [ 522.860856] kmemleak: checksum = 0 [ 522.860860] kmemleak: backtrace: [ 522.860864] pcpu_alloc_noprof+0x87a/0x1170 [ 522.860880] percpu_ref_init+0x37/0x400 [ 522.860892] io_uring_setup+0x44c/0x2000 [ 522.860904] __x64_sys_io_uring_setup+0xc8/0x170 [ 522.860916] do_syscall_64+0xbf/0x360 [ 522.860926] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:26:38 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 23:26:38 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:38 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:38 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:26:38 executing program 2: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:38 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:26:38 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:38 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:38 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:38 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:38 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:38 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:26:47 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:47 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:47 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f0000001240)={0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:47 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:47 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) 23:26:47 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:47 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:47 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:47 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) 23:26:47 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:57 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, 0x0, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:26:57 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:26:57 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x0, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:57 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:57 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:57 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:26:57 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:57 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:57 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:57 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:26:57 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:26:57 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) 23:26:57 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:57 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:26:57 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) [ 542.599560] kmemleak: Found object by alias at 0x607f1a63e894 [ 542.599585] CPU: 1 UID: 0 PID: 7653 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 542.599604] Tainted: [W]=WARN [ 542.599608] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 542.599619] Call Trace: [ 542.599624] [ 542.599629] dump_stack_lvl+0xca/0x120 [ 542.599657] __lookup_object+0x94/0xb0 [ 542.599676] delete_object_full+0x27/0x70 [ 542.599692] free_percpu+0x30/0x1160 [ 542.599710] ? arch_uprobe_clear_state+0x16/0x140 [ 542.599731] futex_hash_free+0x38/0xc0 [ 542.599746] mmput+0x2d3/0x390 [ 542.599766] do_exit+0x79d/0x2970 [ 542.599784] ? __pfx_do_exit+0x10/0x10 [ 542.599798] ? find_held_lock+0x2b/0x80 [ 542.599817] ? get_signal+0x835/0x2340 [ 542.599838] do_group_exit+0xd3/0x2a0 [ 542.599853] get_signal+0x2315/0x2340 [ 542.599871] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 542.599890] ? __pfx_get_signal+0x10/0x10 [ 542.599906] ? do_futex+0x135/0x370 [ 542.599920] ? __pfx_do_futex+0x10/0x10 [ 542.599936] arch_do_signal_or_restart+0x80/0x790 [ 542.599955] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 542.599972] ? __x64_sys_futex+0x1c9/0x4d0 [ 542.599984] ? __x64_sys_futex+0x1d2/0x4d0 [ 542.600000] ? __pfx___x64_sys_futex+0x10/0x10 [ 542.600014] ? xfd_validate_state+0x55/0x180 [ 542.600035] exit_to_user_mode_loop+0x8b/0x110 [ 542.600049] do_syscall_64+0x2f7/0x360 [ 542.600063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.600075] RIP: 0033:0x7f5141970b19 [ 542.600085] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 542.600090] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 542.600102] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 542.600110] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 542.600117] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 542.600124] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 542.600132] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 542.600147] [ 542.600151] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 542.600158] kmemleak: comm "syz-executor.6", pid 7654, jiffies 4295209513 [ 542.600165] kmemleak: min_count = 1 [ 542.600169] kmemleak: count = 0 [ 542.600173] kmemleak: flags = 0x21 [ 542.600177] kmemleak: checksum = 0 [ 542.600180] kmemleak: backtrace: [ 542.600184] pcpu_alloc_noprof+0x87a/0x1170 [ 542.600200] percpu_ref_init+0x37/0x400 [ 542.600211] io_uring_setup+0x44c/0x2000 [ 542.600224] __x64_sys_io_uring_setup+0xc8/0x170 [ 542.600236] do_syscall_64+0xbf/0x360 [ 542.600245] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:26:58 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 542.708405] kmemleak: Found object by alias at 0x607f1a63e26c [ 542.708436] CPU: 0 UID: 0 PID: 7645 Comm: iou-sqp-7642 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 542.708469] Tainted: [W]=WARN [ 542.708476] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 542.708489] Call Trace: [ 542.708496] [ 542.708505] dump_stack_lvl+0xca/0x120 [ 542.708548] __lookup_object+0x94/0xb0 [ 542.708579] delete_object_full+0x27/0x70 [ 542.708615] free_percpu+0x30/0x1160 [ 542.708645] ? arch_uprobe_clear_state+0x16/0x140 [ 542.708692] futex_hash_free+0x38/0xc0 [ 542.708718] mmput+0x2d3/0x390 [ 542.708752] do_exit+0x79d/0x2970 [ 542.708780] ? __pfx_try_to_wake_up+0x10/0x10 [ 542.708815] ? __pfx_do_exit+0x10/0x10 [ 542.708839] ? io_sq_thread+0xfbd/0x1b00 [ 542.708869] ? lock_release+0xc8/0x290 [ 542.708900] io_sq_thread+0xfc9/0x1b00 [ 542.708940] ? __pfx_io_sq_thread+0x10/0x10 [ 542.708973] ? __lock_acquire+0xc65/0x1b70 [ 542.708998] ? __pfx_autoremove_wake_function+0x10/0x10 [ 542.709027] ? __lock_acquire+0xc65/0x1b70 [ 542.709064] ? do_raw_spin_lock+0x123/0x260 [ 542.709094] ? find_held_lock+0x2b/0x80 [ 542.709124] ? __pfx_io_sq_thread+0x10/0x10 [ 542.709155] ? lock_release+0xc8/0x290 [ 542.709180] ? __pfx_io_sq_thread+0x10/0x10 [ 542.709211] ret_from_fork+0x34b/0x430 [ 542.709244] ? __pfx_io_sq_thread+0x10/0x10 [ 542.709274] ret_from_fork_asm+0x1a/0x30 [ 542.709317] [ 542.709324] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 542.709337] kmemleak: comm "syz-executor.6", pid 7666, jiffies 4295209628 [ 542.709351] kmemleak: min_count = 1 [ 542.709358] kmemleak: count = 0 [ 542.709365] kmemleak: flags = 0x21 [ 542.709372] kmemleak: checksum = 0 [ 542.709379] kmemleak: backtrace: [ 542.709385] pcpu_alloc_noprof+0x87a/0x1170 [ 542.709414] percpu_ref_init+0x37/0x400 [ 542.709432] io_uring_setup+0x44c/0x2000 [ 542.709453] __x64_sys_io_uring_setup+0xc8/0x170 [ 542.709478] do_syscall_64+0xbf/0x360 [ 542.709498] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:07 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:07 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:27:07 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:07 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:07 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:07 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:07 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, 0x0, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:07 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xb8, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}]}, 0xb8}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) [ 552.531205] kmemleak: Found object by alias at 0x607f1a63e894 [ 552.531230] CPU: 1 UID: 0 PID: 7681 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 552.531252] Tainted: [W]=WARN [ 552.531257] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 552.531266] Call Trace: [ 552.531271] [ 552.531276] dump_stack_lvl+0xca/0x120 [ 552.531308] __lookup_object+0x94/0xb0 [ 552.531330] delete_object_full+0x27/0x70 [ 552.531350] free_percpu+0x30/0x1160 [ 552.531371] ? arch_uprobe_clear_state+0x16/0x140 [ 552.531396] futex_hash_free+0x38/0xc0 [ 552.531414] mmput+0x2d3/0x390 [ 552.531438] do_exit+0x79d/0x2970 [ 552.531460] ? __pfx_do_exit+0x10/0x10 [ 552.531478] ? find_held_lock+0x2b/0x80 [ 552.531500] ? get_signal+0x835/0x2340 [ 552.531526] do_group_exit+0xd3/0x2a0 [ 552.531545] get_signal+0x2315/0x2340 [ 552.531567] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 552.531594] ? __pfx_get_signal+0x10/0x10 [ 552.531615] ? do_futex+0x135/0x370 [ 552.531632] ? __pfx_do_futex+0x10/0x10 [ 552.531651] arch_do_signal_or_restart+0x80/0x790 [ 552.531673] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 552.531694] ? __x64_sys_futex+0x1c9/0x4d0 [ 552.531710] ? __x64_sys_futex+0x1d2/0x4d0 [ 552.531729] ? __pfx___x64_sys_futex+0x10/0x10 [ 552.531746] ? xfd_validate_state+0x55/0x180 [ 552.531773] exit_to_user_mode_loop+0x8b/0x110 [ 552.531789] do_syscall_64+0x2f7/0x360 [ 552.531804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.531819] RIP: 0033:0x7f5141970b19 [ 552.531831] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 552.531837] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 552.531852] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 552.531861] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 552.531870] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 552.531879] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 552.531888] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 552.531907] [ 552.531912] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 552.531920] kmemleak: comm "syz-executor.4", pid 7680, jiffies 4295219441 [ 552.531929] kmemleak: min_count = 1 [ 552.531934] kmemleak: count = 0 [ 552.531938] kmemleak: flags = 0x21 [ 552.531943] kmemleak: checksum = 0 [ 552.531948] kmemleak: backtrace: [ 552.531952] pcpu_alloc_noprof+0x87a/0x1170 [ 552.531971] percpu_ref_init+0x37/0x400 [ 552.531984] io_uring_setup+0x44c/0x2000 [ 552.531999] __x64_sys_io_uring_setup+0xc8/0x170 [ 552.532014] do_syscall_64+0xbf/0x360 [ 552.532026] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:08 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:08 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xb0, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:08 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) 23:27:08 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:08 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:08 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:08 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:08 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) 23:27:08 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r0}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:08 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x80, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:08 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) 23:27:08 executing program 0: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0xc0, r0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x5}]}, 0xc0}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:16 executing program 0: syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x0) 23:27:16 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x78, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x3}]}, 0x78}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:16 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r0}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:16 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:27:16 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) 23:27:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, 0x0, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:16 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:16 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) 23:27:16 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x70, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xf1}]}, 0x70}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:16 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:27:16 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) 23:27:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:16 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) [ 561.481186] kmemleak: Found object by alias at 0x607f1a63e26c [ 561.481207] CPU: 1 UID: 0 PID: 7769 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 561.481226] Tainted: [W]=WARN [ 561.481230] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 561.481237] Call Trace: [ 561.481242] [ 561.481246] dump_stack_lvl+0xca/0x120 [ 561.481273] __lookup_object+0x94/0xb0 [ 561.481291] delete_object_full+0x27/0x70 [ 561.481307] free_percpu+0x30/0x1160 [ 561.481324] ? arch_uprobe_clear_state+0x16/0x140 [ 561.481345] futex_hash_free+0x38/0xc0 [ 561.481360] mmput+0x2d3/0x390 [ 561.481384] do_exit+0x79d/0x2970 [ 561.481401] ? __pfx_do_exit+0x10/0x10 [ 561.481416] ? find_held_lock+0x2b/0x80 [ 561.481434] ? get_signal+0x835/0x2340 [ 561.481455] do_group_exit+0xd3/0x2a0 [ 561.481470] get_signal+0x2315/0x2340 [ 561.481488] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 561.481505] ? __pfx_get_signal+0x10/0x10 [ 561.481522] ? do_futex+0x135/0x370 [ 561.481536] ? __pfx_do_futex+0x10/0x10 [ 561.481551] arch_do_signal_or_restart+0x80/0x790 [ 561.481569] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 561.481586] ? __x64_sys_futex+0x1c9/0x4d0 [ 561.481599] ? __x64_sys_futex+0x1d2/0x4d0 [ 561.481613] ? __x64_sys_openat+0x142/0x200 [ 561.481630] ? __pfx___x64_sys_futex+0x10/0x10 [ 561.481644] ? xfd_validate_state+0x55/0x180 [ 561.481665] exit_to_user_mode_loop+0x8b/0x110 [ 561.481679] do_syscall_64+0x2f7/0x360 [ 561.481691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.481704] RIP: 0033:0x7fcf751aeb19 [ 561.481713] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 561.481718] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 561.481730] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 23:27:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000001280)="1a48132eba9bd422fadca2c43d0853e3a376ebc735816987b125a9ded5b3f9e521b4076a8a0cdcc4e84362369091b3e270632063f9615327559baea40c1810a339de7f9aa29b10dca02d6f05e0ae615e041d08cf05319378074e6c2e6f1265433445cd51d7bcfca23b86f0ea4b8d65fc50318ee6a4dc2a1e8d01d0c54e3b2c61850713fa0fd27375c823d7af04f6210a32ed3d42595b160f0d5ce89d62379fd1beba1b60243913e8ccc53d24ef52c430a89ab67ae48523b2c6e7c4fb188aa41ae7ff5d814098d0be8670af80e8df6f63917c3a4974484d3d", 0xd8}, {&(0x7f0000001380)="2607fb6d91d4a5b0cf7d4c10411191c704d2fb043d6f6f50f209058718021d1a499b0e7ff20cda16176f1c0d35d349387a6feff86482e982ed2b604ae967974359fbd9594da9931453c87d0eb6bfdd8ca155a77b0726e1e4a271ceca67a9aa01807241fcb2e583825a0e9e08e301d061b161", 0x72}], 0x2, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) [ 561.481738] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 561.481745] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 561.481752] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 561.481759] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 561.481774] [ 561.481778] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 561.481785] kmemleak: comm "syz-executor.6", pid 7773, jiffies 4295228397 [ 561.481792] kmemleak: min_count = 1 [ 561.481796] kmemleak: count = 0 [ 561.481799] kmemleak: flags = 0x21 [ 561.481803] kmemleak: checksum = 0 [ 561.481807] kmemleak: backtrace: [ 561.481811] pcpu_alloc_noprof+0x87a/0x1170 [ 561.481826] percpu_ref_init+0x37/0x400 [ 561.481837] io_uring_setup+0x44c/0x2000 [ 561.481850] __x64_sys_io_uring_setup+0xc8/0x170 [ 561.481861] do_syscall_64+0xbf/0x360 [ 561.481871] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:16 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:16 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0x0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:16 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:17 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r0}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:17 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') [ 561.601317] kmemleak: Found object by alias at 0x607f1a63e894 [ 561.601349] CPU: 0 UID: 0 PID: 7768 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 561.601383] Tainted: [W]=WARN [ 561.601390] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 561.601403] Call Trace: [ 561.601411] [ 561.601419] dump_stack_lvl+0xca/0x120 [ 561.601467] __lookup_object+0x94/0xb0 [ 561.601498] delete_object_full+0x27/0x70 [ 561.601529] free_percpu+0x30/0x1160 [ 561.601559] ? arch_uprobe_clear_state+0x16/0x140 [ 561.601602] futex_hash_free+0x38/0xc0 [ 561.601628] mmput+0x2d3/0x390 [ 561.601663] do_exit+0x79d/0x2970 [ 561.601688] ? signal_wake_up_state+0x85/0x120 [ 561.601717] ? zap_other_threads+0x2b9/0x3a0 [ 561.601747] ? __pfx_do_exit+0x10/0x10 [ 561.601771] ? do_group_exit+0x1c3/0x2a0 [ 561.601797] ? lock_release+0xc8/0x290 [ 561.601828] do_group_exit+0xd3/0x2a0 [ 561.601856] __x64_sys_exit_group+0x3e/0x50 [ 561.601883] x64_sys_call+0x18c5/0x18d0 [ 561.601912] do_syscall_64+0xbf/0x360 [ 561.601936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.601957] RIP: 0033:0x7f5141970b19 [ 561.601973] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 561.601983] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 561.602005] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 561.602019] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 561.602032] RBP: 0000000000000000 R08: 0000001b2d122c48 R09: 0000000000000000 [ 561.602046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 561.602058] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 561.602087] [ 561.602094] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 561.602107] kmemleak: comm "syz-executor.6", pid 7783, jiffies 4295228519 [ 561.602120] kmemleak: min_count = 1 [ 561.602128] kmemleak: count = 0 [ 561.602134] kmemleak: flags = 0x21 [ 561.602142] kmemleak: checksum = 0 [ 561.602148] kmemleak: backtrace: [ 561.602154] pcpu_alloc_noprof+0x87a/0x1170 [ 561.602183] percpu_ref_init+0x37/0x400 [ 561.602202] io_uring_setup+0x44c/0x2000 [ 561.602224] __x64_sys_io_uring_setup+0xc8/0x170 [ 561.602246] do_syscall_64+0xbf/0x360 [ 561.602264] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:25 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x68, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:25 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001440)=[@tclass={{0x14, 0x29, 0x43, 0x5}}, @rthdr={{0x28, 0x29, 0x39, {0xa6, 0x2, 0x1, 0x3f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0xe3, 0x0, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}]}}}], 0x60}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:25 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:25 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:25 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0x0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:25 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:25 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) [ 570.008886] kmemleak: Found object by alias at 0x607f1a63e894 [ 570.008908] CPU: 1 UID: 0 PID: 7815 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 570.008927] Tainted: [W]=WARN [ 570.008930] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 570.008938] Call Trace: [ 570.008942] [ 570.008947] dump_stack_lvl+0xca/0x120 [ 570.008974] __lookup_object+0x94/0xb0 [ 570.008991] delete_object_full+0x27/0x70 [ 570.009018] free_percpu+0x30/0x1160 [ 570.009035] ? arch_uprobe_clear_state+0x16/0x140 [ 570.009055] futex_hash_free+0x38/0xc0 [ 570.009070] mmput+0x2d3/0x390 [ 570.009090] do_exit+0x79d/0x2970 [ 570.009107] ? __pfx_do_exit+0x10/0x10 [ 570.009121] ? find_held_lock+0x2b/0x80 [ 570.009140] ? get_signal+0x835/0x2340 [ 570.009160] do_group_exit+0xd3/0x2a0 [ 570.009175] get_signal+0x2315/0x2340 [ 570.009193] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 570.009210] ? __pfx_get_signal+0x10/0x10 [ 570.009227] ? __schedule+0xe91/0x3590 [ 570.009248] arch_do_signal_or_restart+0x80/0x790 [ 570.009266] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 570.009283] ? __x64_sys_futex+0x1c9/0x4d0 [ 570.009295] ? __x64_sys_futex+0x1d2/0x4d0 [ 570.009310] ? __x64_sys_openat+0x142/0x200 [ 570.009327] ? __pfx___x64_sys_futex+0x10/0x10 [ 570.009341] ? xfd_validate_state+0x55/0x180 [ 570.009362] exit_to_user_mode_loop+0x8b/0x110 [ 570.009375] do_syscall_64+0x2f7/0x360 [ 570.009388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.009400] RIP: 0033:0x7f5141970b19 [ 570.009409] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 570.009414] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 570.009426] RAX: 0000000000000001 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 570.009433] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5141a83f6c [ 570.009440] RBP: 00007f5141a83f60 R08: 000000000000000e R09: 0000000000000000 [ 570.009447] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f5141a83f6c [ 570.009454] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 570.009470] [ 570.009474] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 570.009481] kmemleak: comm "syz-executor.4", pid 7821, jiffies 4295236927 [ 570.009488] kmemleak: min_count = 1 [ 570.009491] kmemleak: count = 0 [ 570.009495] kmemleak: flags = 0x21 [ 570.009499] kmemleak: checksum = 0 [ 570.009503] kmemleak: backtrace: [ 570.009506] pcpu_alloc_noprof+0x87a/0x1170 [ 570.009522] percpu_ref_init+0x37/0x400 [ 570.009533] io_uring_setup+0x44c/0x2000 [ 570.009545] __x64_sys_io_uring_setup+0xc8/0x170 [ 570.009557] do_syscall_64+0xbf/0x360 [ 570.009566] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:25 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:25 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) 23:27:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x2c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:35 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:35 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0x0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:35 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:35 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x2c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:35 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:35 executing program 7: openat$tun(0xffffffffffffff9c, 0x0, 0x10400, 0x0) 23:27:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) [ 580.097877] kmemleak: Found object by alias at 0x607f1a63e894 [ 580.097908] CPU: 1 UID: 0 PID: 7851 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 580.097941] Tainted: [W]=WARN [ 580.097947] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 580.097960] Call Trace: [ 580.097967] [ 580.097975] dump_stack_lvl+0xca/0x120 [ 580.098017] __lookup_object+0x94/0xb0 [ 580.098047] delete_object_full+0x27/0x70 [ 580.098076] free_percpu+0x30/0x1160 [ 580.098106] ? arch_uprobe_clear_state+0x16/0x140 [ 580.098141] futex_hash_free+0x38/0xc0 [ 580.098166] mmput+0x2d3/0x390 [ 580.098200] do_exit+0x79d/0x2970 [ 580.098225] ? signal_wake_up_state+0x85/0x120 [ 580.098252] ? zap_other_threads+0x2b9/0x3a0 [ 580.098281] ? __pfx_do_exit+0x10/0x10 [ 580.098305] ? do_group_exit+0x1c3/0x2a0 [ 580.098330] ? lock_release+0xc8/0x290 [ 580.098360] do_group_exit+0xd3/0x2a0 [ 580.098387] __x64_sys_exit_group+0x3e/0x50 [ 580.098412] x64_sys_call+0x18c5/0x18d0 [ 580.098440] do_syscall_64+0xbf/0x360 [ 580.098463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.098483] RIP: 0033:0x7f5141970b19 [ 580.098499] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 580.098509] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 580.098529] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 580.098543] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 580.098556] RBP: 0000000000000000 R08: 0000001b2d12001c R09: 0000000000000000 [ 580.098568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 580.098588] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 580.098616] [ 580.098622] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 580.098635] kmemleak: comm "syz-executor.6", pid 7862, jiffies 4295246965 [ 580.098647] kmemleak: min_count = 1 [ 580.098654] kmemleak: count = 0 [ 580.098661] kmemleak: flags = 0x21 [ 580.098668] kmemleak: checksum = 0 [ 580.098674] kmemleak: backtrace: [ 580.098680] pcpu_alloc_noprof+0x87a/0x1170 [ 580.098708] percpu_ref_init+0x37/0x400 [ 580.098726] io_uring_setup+0x44c/0x2000 [ 580.098747] __x64_sys_io_uring_setup+0xc8/0x170 [ 580.098768] do_syscall_64+0xbf/0x360 [ 580.098785] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:35 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:35 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x2c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:35 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:35 executing program 7: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) 23:27:35 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x54, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:35 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:35 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x20000040) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:35 executing program 7: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) 23:27:45 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:45 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:27:45 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:45 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:45 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:45 executing program 7: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) 23:27:45 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:45 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 589.848236] kmemleak: Found object by alias at 0x607f1a63e894 [ 589.848259] CPU: 1 UID: 0 PID: 7919 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 589.848278] Tainted: [W]=WARN [ 589.848282] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 589.848290] Call Trace: [ 589.848294] [ 589.848300] dump_stack_lvl+0xca/0x120 [ 589.848338] __lookup_object+0x94/0xb0 [ 589.848357] delete_object_full+0x27/0x70 [ 589.848374] free_percpu+0x30/0x1160 [ 589.848392] ? arch_uprobe_clear_state+0x16/0x140 [ 589.848414] futex_hash_free+0x38/0xc0 [ 589.848429] mmput+0x2d3/0x390 [ 589.848449] do_exit+0x79d/0x2970 [ 589.848463] ? signal_wake_up_state+0x9f/0x120 [ 589.848480] ? zap_other_threads+0x2b9/0x3a0 [ 589.848497] ? __pfx_do_exit+0x10/0x10 [ 589.848510] ? do_group_exit+0x1c3/0x2a0 [ 589.848524] ? lock_release+0xc8/0x290 [ 589.848542] do_group_exit+0xd3/0x2a0 [ 589.848557] __x64_sys_exit_group+0x3e/0x50 [ 589.848572] x64_sys_call+0x18c5/0x18d0 [ 589.848594] do_syscall_64+0xbf/0x360 [ 589.848607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.848620] RIP: 0033:0x7f5141970b19 [ 589.848629] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 589.848634] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 589.848647] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 589.848655] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 589.848662] RBP: 0000000000000000 R08: 0000001b2d12001c R09: 0000000000000000 [ 589.848670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 589.848677] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 589.848693] [ 589.848697] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 589.848704] kmemleak: comm "syz-executor.4", pid 7926, jiffies 4295256754 [ 589.848711] kmemleak: min_count = 1 [ 589.848715] kmemleak: count = 0 [ 589.848719] kmemleak: flags = 0x21 [ 589.848723] kmemleak: checksum = 0 [ 589.848727] kmemleak: backtrace: [ 589.848731] pcpu_alloc_noprof+0x87a/0x1170 [ 589.848747] percpu_ref_init+0x37/0x400 [ 589.848759] io_uring_setup+0x44c/0x2000 [ 589.848771] __x64_sys_io_uring_setup+0xc8/0x170 [ 589.848783] do_syscall_64+0xbf/0x360 [ 589.848792] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:45 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:45 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:54 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:54 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:54 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:54 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:54 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:54 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x54, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:54 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) 23:27:54 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:54 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:54 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56"}}}}}}, 0x12) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:27:54 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) [ 599.439180] kmemleak: Found object by alias at 0x607f1a63e894 [ 599.439201] CPU: 1 UID: 0 PID: 7984 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 599.439220] Tainted: [W]=WARN [ 599.439224] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 599.439231] Call Trace: [ 599.439235] [ 599.439240] dump_stack_lvl+0xca/0x120 [ 599.439267] __lookup_object+0x94/0xb0 [ 599.439284] delete_object_full+0x27/0x70 [ 599.439300] free_percpu+0x30/0x1160 [ 599.439318] ? arch_uprobe_clear_state+0x16/0x140 [ 599.439338] futex_hash_free+0x38/0xc0 [ 599.439353] mmput+0x2d3/0x390 [ 599.439373] do_exit+0x79d/0x2970 [ 599.439391] ? __pfx_do_exit+0x10/0x10 [ 599.439405] ? find_held_lock+0x2b/0x80 [ 599.439424] ? get_signal+0x835/0x2340 [ 599.439444] do_group_exit+0xd3/0x2a0 [ 599.439460] get_signal+0x2315/0x2340 [ 599.439491] ? __pfx_get_signal+0x10/0x10 [ 599.439512] ? do_futex+0x135/0x370 [ 599.439526] ? __pfx_do_futex+0x10/0x10 [ 599.439542] arch_do_signal_or_restart+0x80/0x790 [ 599.439560] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 599.439576] ? __x64_sys_futex+0x1c9/0x4d0 [ 599.439595] ? __x64_sys_futex+0x1d2/0x4d0 [ 599.439610] ? __pfx___x64_sys_futex+0x10/0x10 [ 599.439624] ? xfd_validate_state+0x55/0x180 [ 599.439645] exit_to_user_mode_loop+0x8b/0x110 [ 599.439659] do_syscall_64+0x2f7/0x360 [ 599.439671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.439684] RIP: 0033:0x7f5141970b19 [ 599.439693] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 599.439698] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 599.439710] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 599.439718] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 599.439724] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 599.439731] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 599.439738] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 599.439754] [ 599.439758] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 599.439764] kmemleak: comm "syz-executor.6", pid 7996, jiffies 4295266353 [ 599.439772] kmemleak: min_count = 1 [ 599.439775] kmemleak: count = 0 [ 599.439779] kmemleak: flags = 0x21 [ 599.439783] kmemleak: checksum = 0 [ 599.439787] kmemleak: backtrace: [ 599.439790] pcpu_alloc_noprof+0x87a/0x1170 [ 599.439806] percpu_ref_init+0x37/0x400 [ 599.439817] io_uring_setup+0x44c/0x2000 [ 599.439829] __x64_sys_io_uring_setup+0xc8/0x170 [ 599.439840] do_syscall_64+0xbf/0x360 [ 599.439850] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:27:54 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000001640)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:27:54 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x40, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd2}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:27:54 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:28:05 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56"}}}}}}, 0x12) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:05 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:05 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:05 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00', 0x0}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, r1}, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r3) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r4, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:05 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x38, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:05 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) 23:28:05 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:05 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:05 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:15 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:15 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:15 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:15 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:15 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56"}}}}}}, 0x12) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:15 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:15 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:15 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:15 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d"}}}}}}, 0x21) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:15 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r1) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:15 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:15 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:25 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:25 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r1) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:25 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:25 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d"}}}}}}, 0x21) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:25 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:25 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:25 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:25 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001a40)={'syztnl2\x00', &(0x7f0000001980)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0x5, 0x5, {{0x25, 0x4, 0x0, 0x24, 0x94, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xc2, [@multicast2]}, @rr={0x7, 0x23, 0x89, [@private=0xa010102, @remote, @local, @multicast2, @broadcast, @multicast1, @loopback, @loopback]}, @cipso={0x86, 0x4f, 0x1, [{0x2, 0x12, "756cab66c06569d7e88b1d0c4919aa00"}, {0x0, 0xe, "a7ed5cc51376b3c738858f70"}, {0x6, 0xb, "ad4ab96b7bd77e2b00"}, {0x6, 0xd, "07c19eedc0d7273ffb7e43"}, {0x7, 0x11, "3bd675dadd1912ceda2117997c67f3"}]}]}}}}}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:25 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:25 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:25 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:35 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:35 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d"}}}}}}, 0x21) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:35 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@private2, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000880)=0xe8) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r1) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:35 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:35 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:35 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, 0x0, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0xdac55b8d72c8581a}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x24004010) 23:28:35 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:35 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) [ 639.789688] kmemleak: Found object by alias at 0x607f1a63e26c [ 639.789709] CPU: 0 UID: 0 PID: 8149 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 639.789727] Tainted: [W]=WARN [ 639.789731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 639.789738] Call Trace: [ 639.789743] [ 639.789748] dump_stack_lvl+0xca/0x120 [ 639.789774] __lookup_object+0x94/0xb0 [ 639.789792] delete_object_full+0x27/0x70 [ 639.789808] free_percpu+0x30/0x1160 [ 639.789825] ? arch_uprobe_clear_state+0x16/0x140 [ 639.789846] futex_hash_free+0x38/0xc0 [ 639.789860] mmput+0x2d3/0x390 [ 639.789879] do_exit+0x79d/0x2970 [ 639.789901] ? signal_wake_up_state+0x85/0x120 [ 639.789917] ? zap_other_threads+0x2b9/0x3a0 [ 639.789933] ? __pfx_do_exit+0x10/0x10 [ 639.789946] ? do_group_exit+0x1c3/0x2a0 [ 639.789960] ? lock_release+0xc8/0x290 [ 639.789977] do_group_exit+0xd3/0x2a0 [ 639.789992] __x64_sys_exit_group+0x3e/0x50 [ 639.790006] x64_sys_call+0x18c5/0x18d0 [ 639.790022] do_syscall_64+0xbf/0x360 [ 639.790035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.790047] RIP: 0033:0x7fcf751aeb19 [ 639.790056] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 639.790061] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 639.790073] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 639.790081] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 639.790088] RBP: 0000000000000000 R08: 0000001b2d024314 R09: 0000000000000000 [ 639.790095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 639.790102] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 639.790117] [ 639.790121] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 639.790128] kmemleak: comm "syz-executor.2", pid 8159, jiffies 4295306699 [ 639.790138] kmemleak: min_count = 1 [ 639.790142] kmemleak: count = 0 [ 639.790145] kmemleak: flags = 0x21 [ 639.790149] kmemleak: checksum = 0 [ 639.790153] kmemleak: backtrace: [ 639.790157] pcpu_alloc_noprof+0x87a/0x1170 [ 639.790173] percpu_ref_init+0x37/0x400 [ 639.790183] io_uring_setup+0x44c/0x2000 [ 639.790196] __x64_sys_io_uring_setup+0xc8/0x170 [ 639.790207] do_syscall_64+0xbf/0x360 [ 639.790217] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:28:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:35 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x24004010) 23:28:35 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:35 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x30, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:35 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 639.960457] kmemleak: Found object by alias at 0x607f1a63e26c [ 639.960477] CPU: 0 UID: 0 PID: 8169 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 639.960496] Tainted: [W]=WARN [ 639.960500] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 639.960507] Call Trace: [ 639.960511] [ 639.960516] dump_stack_lvl+0xca/0x120 [ 639.960542] __lookup_object+0x94/0xb0 [ 639.960560] delete_object_full+0x27/0x70 [ 639.960581] free_percpu+0x30/0x1160 [ 639.960598] ? arch_uprobe_clear_state+0x16/0x140 [ 639.960619] futex_hash_free+0x38/0xc0 [ 639.960633] mmput+0x2d3/0x390 [ 639.960653] do_exit+0x79d/0x2970 [ 639.960670] ? __pfx_do_exit+0x10/0x10 [ 639.960685] ? find_held_lock+0x2b/0x80 [ 639.960703] ? get_signal+0x835/0x2340 [ 639.960724] do_group_exit+0xd3/0x2a0 [ 639.960739] get_signal+0x2315/0x2340 [ 639.960757] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 639.960775] ? __pfx_get_signal+0x10/0x10 [ 639.960792] ? do_futex+0x135/0x370 [ 639.960806] ? __pfx_do_futex+0x10/0x10 [ 639.960821] arch_do_signal_or_restart+0x80/0x790 [ 639.960840] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 639.960856] ? __x64_sys_futex+0x1c9/0x4d0 [ 639.960869] ? __x64_sys_futex+0x1d2/0x4d0 [ 639.960884] ? __pfx___x64_sys_futex+0x10/0x10 [ 639.960898] ? xfd_validate_state+0x55/0x180 [ 639.960919] exit_to_user_mode_loop+0x8b/0x110 [ 639.960932] do_syscall_64+0x2f7/0x360 [ 639.960945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.960957] RIP: 0033:0x7fcf751aeb19 [ 639.960966] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 639.960971] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 639.960983] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 639.960991] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 639.960998] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 639.961005] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 639.961012] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 639.961028] [ 639.961031] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 639.961039] kmemleak: comm "syz-executor.6", pid 8177, jiffies 4295306850 [ 639.961046] kmemleak: min_count = 1 [ 639.961049] kmemleak: count = 0 [ 639.961053] kmemleak: flags = 0x21 [ 639.961057] kmemleak: checksum = 0 [ 639.961061] kmemleak: backtrace: [ 639.961064] pcpu_alloc_noprof+0x87a/0x1170 [ 639.961080] percpu_ref_init+0x37/0x400 [ 639.961091] io_uring_setup+0x44c/0x2000 [ 639.961103] __x64_sys_io_uring_setup+0xc8/0x170 [ 639.961114] do_syscall_64+0xbf/0x360 [ 639.961124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.995778] kmemleak: Found object by alias at 0x607f1a63e894 [ 639.995793] CPU: 0 UID: 0 PID: 8175 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 639.995811] Tainted: [W]=WARN [ 639.995814] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 639.995821] Call Trace: [ 639.995825] [ 639.995829] dump_stack_lvl+0xca/0x120 [ 639.995852] __lookup_object+0x94/0xb0 [ 639.995868] delete_object_full+0x27/0x70 [ 639.995885] free_percpu+0x30/0x1160 [ 639.995902] ? arch_uprobe_clear_state+0x16/0x140 [ 639.995922] futex_hash_free+0x38/0xc0 [ 639.995935] mmput+0x2d3/0x390 [ 639.995954] do_exit+0x79d/0x2970 [ 639.995972] ? __pfx_do_exit+0x10/0x10 [ 639.995986] ? find_held_lock+0x2b/0x80 [ 639.996004] ? get_signal+0x835/0x2340 [ 639.996024] do_group_exit+0xd3/0x2a0 [ 639.996040] get_signal+0x2315/0x2340 [ 639.996057] ? put_task_stack+0xd2/0x240 [ 639.996072] ? __pfx_get_signal+0x10/0x10 [ 639.996089] ? __schedule+0xe91/0x3590 [ 639.996110] arch_do_signal_or_restart+0x80/0x790 [ 639.996128] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 639.996144] ? __x64_sys_futex+0x1c9/0x4d0 [ 639.996157] ? __x64_sys_futex+0x1d2/0x4d0 [ 639.996171] ? __x64_sys_openat+0x142/0x200 [ 639.996189] ? __pfx___x64_sys_futex+0x10/0x10 [ 639.996202] ? ksys_write+0x1a3/0x240 [ 639.996219] exit_to_user_mode_loop+0x8b/0x110 [ 639.996232] do_syscall_64+0x2f7/0x360 [ 639.996244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.996256] RIP: 0033:0x7f5141970b19 [ 639.996265] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 639.996270] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 639.996282] RAX: 0000000000000001 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 639.996290] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5141a83f6c [ 639.996297] RBP: 00007f5141a83f60 R08: 0000000000000002 R09: 0000000000000000 [ 639.996304] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f5141a83f6c [ 639.996311] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 639.996326] [ 639.996330] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 639.996337] kmemleak: comm "syz-executor.6", pid 8177, jiffies 4295306862 [ 639.996343] kmemleak: min_count = 1 [ 639.996347] kmemleak: count = 0 [ 639.996351] kmemleak: flags = 0x21 [ 639.996355] kmemleak: checksum = 0 [ 639.996358] kmemleak: backtrace: [ 639.996362] pcpu_alloc_noprof+0x87a/0x1170 [ 639.996378] percpu_ref_init+0x37/0x400 [ 639.996389] io_uring_setup+0x44c/0x2000 [ 639.996400] __x64_sys_io_uring_setup+0xc8/0x170 [ 639.996412] do_syscall_64+0xbf/0x360 [ 639.996421] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:28:44 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:44 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 23:28:44 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:44 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:44 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:44 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:44 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:44 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, &(0x7f0000000880)) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:44 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:44 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:44 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:44 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:44 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, &(0x7f0000000880)) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:44 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000014c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 23:28:44 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:44 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:44 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:44 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:44 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:44 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:44 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:44 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:44 executing program 0: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:53 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:28:53 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:53 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:28:53 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:53 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc"}}}}}}, 0x2c) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:28:53 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:53 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:28:53 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:53 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:28:53 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7f}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) [ 658.006221] kmemleak: Found object by alias at 0x607f1a63e26c [ 658.006254] CPU: 1 UID: 0 PID: 8265 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 658.006288] Tainted: [W]=WARN [ 658.006295] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 658.006308] Call Trace: [ 658.006315] [ 658.006323] dump_stack_lvl+0xca/0x120 [ 658.006367] __lookup_object+0x94/0xb0 [ 658.006398] delete_object_full+0x27/0x70 [ 658.006428] free_percpu+0x30/0x1160 [ 658.006458] ? arch_uprobe_clear_state+0x16/0x140 [ 658.006495] futex_hash_free+0x38/0xc0 [ 658.006521] mmput+0x2d3/0x390 [ 658.006562] do_exit+0x79d/0x2970 [ 658.006594] ? __pfx_do_exit+0x10/0x10 [ 658.006621] ? find_held_lock+0x2b/0x80 [ 658.006654] ? get_signal+0x835/0x2340 [ 658.006691] do_group_exit+0xd3/0x2a0 [ 658.006719] get_signal+0x2315/0x2340 [ 658.006752] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 658.006784] ? __pfx_get_signal+0x10/0x10 [ 658.006815] ? do_futex+0x135/0x370 [ 658.006841] ? __pfx_do_futex+0x10/0x10 [ 658.006870] arch_do_signal_or_restart+0x80/0x790 [ 658.006902] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 658.006933] ? __x64_sys_futex+0x1c9/0x4d0 [ 658.006956] ? __x64_sys_futex+0x1d2/0x4d0 [ 658.006985] ? __pfx___x64_sys_futex+0x10/0x10 [ 658.007010] ? xfd_validate_state+0x55/0x180 [ 658.007048] exit_to_user_mode_loop+0x8b/0x110 [ 658.007072] do_syscall_64+0x2f7/0x360 [ 658.007095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.007117] RIP: 0033:0x7fcf751aeb19 [ 658.007134] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 658.007143] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 658.007165] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 658.007179] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 658.007192] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 658.007205] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 658.007218] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 658.007247] [ 658.007254] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 658.007267] kmemleak: comm "syz-executor.6", pid 8267, jiffies 4295324863 [ 658.007280] kmemleak: min_count = 1 [ 658.007287] kmemleak: count = 0 [ 658.007294] kmemleak: flags = 0x21 [ 658.007301] kmemleak: checksum = 0 [ 658.007307] kmemleak: backtrace: [ 658.007313] pcpu_alloc_noprof+0x87a/0x1170 [ 658.007342] percpu_ref_init+0x37/0x400 [ 658.007361] io_uring_setup+0x44c/0x2000 [ 658.007382] __x64_sys_io_uring_setup+0xc8/0x170 [ 658.007403] do_syscall_64+0xbf/0x360 [ 658.007421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.052446] kmemleak: Found object by alias at 0x607f1a63e894 [ 658.052473] CPU: 1 UID: 0 PID: 8268 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 658.052506] Tainted: [W]=WARN [ 658.052513] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 658.052525] Call Trace: [ 658.052532] [ 658.052540] dump_stack_lvl+0xca/0x120 [ 658.052589] __lookup_object+0x94/0xb0 [ 658.052619] delete_object_full+0x27/0x70 [ 658.052650] free_percpu+0x30/0x1160 [ 658.052680] ? arch_uprobe_clear_state+0x16/0x140 [ 658.052716] futex_hash_free+0x38/0xc0 [ 658.052741] mmput+0x2d3/0x390 [ 658.052775] do_exit+0x79d/0x2970 [ 658.052801] ? lock_release+0xc8/0x290 [ 658.052831] ? __pfx_do_exit+0x10/0x10 [ 658.052857] ? find_held_lock+0x2b/0x80 [ 658.052889] ? get_signal+0x835/0x2340 [ 658.052926] do_group_exit+0xd3/0x2a0 [ 658.052955] get_signal+0x2315/0x2340 [ 658.052989] ? putname.part.0+0x11b/0x160 [ 658.053024] ? __pfx_get_signal+0x10/0x10 [ 658.053055] ? do_futex+0x135/0x370 [ 658.053081] ? __pfx_do_futex+0x10/0x10 [ 658.053109] arch_do_signal_or_restart+0x80/0x790 [ 658.053142] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 658.053173] ? __x64_sys_futex+0x1c9/0x4d0 [ 658.053196] ? __x64_sys_futex+0x1d2/0x4d0 [ 658.053223] ? __x64_sys_openat+0x142/0x200 [ 658.053255] ? __pfx___x64_sys_futex+0x10/0x10 [ 658.053281] ? xfd_validate_state+0x55/0x180 [ 658.053319] exit_to_user_mode_loop+0x8b/0x110 [ 658.053343] do_syscall_64+0x2f7/0x360 [ 658.053366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.053388] RIP: 0033:0x7f5141970b19 [ 658.053404] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 658.053413] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 658.053434] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 658.053449] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 658.053462] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 658.053475] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 658.053488] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 658.053517] [ 658.053524] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 658.053536] kmemleak: comm "syz-executor.6", pid 8267, jiffies 4295324920 [ 658.053549] kmemleak: min_count = 1 [ 658.053556] kmemleak: count = 0 [ 658.053563] kmemleak: flags = 0x21 [ 658.053570] kmemleak: checksum = 0 [ 658.053577] kmemleak: backtrace: [ 658.053583] pcpu_alloc_noprof+0x87a/0x1170 [ 658.053612] percpu_ref_init+0x37/0x400 [ 658.053631] io_uring_setup+0x44c/0x2000 [ 658.053652] __x64_sys_io_uring_setup+0xc8/0x170 [ 658.053674] do_syscall_64+0xbf/0x360 [ 658.053692] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:28:53 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:28:53 executing program 0: r0 = syz_open_procfs(0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:28:53 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:04 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc"}}}}}}, 0x2c) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:04 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:04 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:04 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:04 executing program 0: r0 = syz_open_procfs(0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:29:04 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:04 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:04 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:04 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:04 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:04 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:04 executing program 0: r0 = syz_open_procfs(0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:29:04 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:04 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc"}}}}}}, 0x2c) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:04 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:15 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:15 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:15 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:15 executing program 7: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:15 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x0, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:15 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:29:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:15 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:15 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:29:15 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:15 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:15 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:15 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:24 executing program 0: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) 23:29:24 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506"}}}}}}, 0x2e) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:24 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:24 executing program 7: syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:24 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:24 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:24 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x0, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:24 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:24 executing program 7: syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:24 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, 0x0, &(0x7f0000000240)) [ 689.033767] kmemleak: Found object by alias at 0x607f1a63e26c [ 689.033788] CPU: 1 UID: 0 PID: 8380 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 689.033806] Tainted: [W]=WARN [ 689.033810] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 689.033817] Call Trace: [ 689.033821] [ 689.033826] dump_stack_lvl+0xca/0x120 [ 689.033853] __lookup_object+0x94/0xb0 [ 689.033871] delete_object_full+0x27/0x70 [ 689.033887] free_percpu+0x30/0x1160 [ 689.033904] ? arch_uprobe_clear_state+0x16/0x140 [ 689.033925] futex_hash_free+0x38/0xc0 [ 689.033940] mmput+0x2d3/0x390 [ 689.033959] do_exit+0x79d/0x2970 [ 689.033973] ? signal_wake_up_state+0x85/0x120 [ 689.033990] ? zap_other_threads+0x2b9/0x3a0 [ 689.034006] ? __pfx_do_exit+0x10/0x10 [ 689.034019] ? do_group_exit+0x1c3/0x2a0 [ 689.034033] ? lock_release+0xc8/0x290 [ 689.034050] do_group_exit+0xd3/0x2a0 [ 689.034065] __x64_sys_exit_group+0x3e/0x50 [ 689.034079] x64_sys_call+0x18c5/0x18d0 [ 689.034095] do_syscall_64+0xbf/0x360 [ 689.034108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.034119] RIP: 0033:0x7fcf751aeb19 [ 689.034128] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 689.034133] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 689.034146] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 689.034153] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 689.034160] RBP: 0000000000000000 R08: 0000001b2d023d8c R09: 0000000000000000 [ 689.034167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.034174] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 689.034189] [ 689.034193] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 689.034200] kmemleak: comm "syz-executor.6", pid 8390, jiffies 4295355939 [ 689.034207] kmemleak: min_count = 1 [ 689.034211] kmemleak: count = 0 [ 689.034214] kmemleak: flags = 0x21 [ 689.034218] kmemleak: checksum = 0 [ 689.034222] kmemleak: backtrace: [ 689.034225] pcpu_alloc_noprof+0x87a/0x1170 [ 689.034241] percpu_ref_init+0x37/0x400 [ 689.034252] io_uring_setup+0x44c/0x2000 [ 689.034264] __x64_sys_io_uring_setup+0xc8/0x170 [ 689.034276] do_syscall_64+0xbf/0x360 [ 689.034285] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:29:24 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:24 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x20, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 23:29:33 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x0, 0x3, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:33 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001b00)={0x14}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00), 0xc, &(0x7f0000001d00)={&(0x7f0000001c40)={0x28, r0, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}}, 0x0) 23:29:33 executing program 7: syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:29:33 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:33 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, 0x0, 0x0) 23:29:33 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, 0x0) 23:29:33 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:33 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:33 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, 0x0) 23:29:33 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:33 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_open_procfs(0x0, 0x0) 23:29:33 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:33 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:42 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:42 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) 23:29:42 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:42 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x1000, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:42 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:42 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0x0, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:42 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:42 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:42 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:29:51 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:29:51 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:29:51 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:51 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:51 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:51 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:29:51 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0x0, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:51 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:52 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, 0x0, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:52 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:52 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0x0, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:29:52 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:29:52 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) 23:29:52 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:52 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:29:52 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) [ 716.823287] kmemleak: Found object by alias at 0x607f1a63e894 [ 716.823307] CPU: 1 UID: 0 PID: 8542 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 716.823325] Tainted: [W]=WARN [ 716.823329] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 716.823337] Call Trace: [ 716.823341] [ 716.823346] dump_stack_lvl+0xca/0x120 [ 716.823377] __lookup_object+0x94/0xb0 [ 716.823399] delete_object_full+0x27/0x70 [ 716.823416] free_percpu+0x30/0x1160 [ 716.823433] ? arch_uprobe_clear_state+0x16/0x140 [ 716.823454] futex_hash_free+0x38/0xc0 [ 716.823469] mmput+0x2d3/0x390 [ 716.823488] do_exit+0x79d/0x2970 [ 716.823502] ? signal_wake_up_state+0x85/0x120 [ 716.823518] ? zap_other_threads+0x2b9/0x3a0 [ 716.823535] ? __pfx_do_exit+0x10/0x10 [ 716.823548] ? do_group_exit+0x1c3/0x2a0 [ 716.823562] ? lock_release+0xc8/0x290 [ 716.823580] do_group_exit+0xd3/0x2a0 [ 716.823595] __x64_sys_exit_group+0x3e/0x50 [ 716.823610] x64_sys_call+0x18c5/0x18d0 [ 716.823626] do_syscall_64+0xbf/0x360 [ 716.823639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 716.823651] RIP: 0033:0x7f5141970b19 [ 716.823660] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 716.823665] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 716.823677] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 716.823685] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 716.823693] RBP: 0000000000000000 R08: 0000001b2d123d80 R09: 0000000000000000 [ 716.823700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 716.823707] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 716.823723] [ 716.823726] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 716.823733] kmemleak: comm "syz-executor.6", pid 8551, jiffies 4295383735 [ 716.823741] kmemleak: min_count = 1 [ 716.823745] kmemleak: count = 0 [ 716.823748] kmemleak: flags = 0x21 [ 716.823752] kmemleak: checksum = 0 [ 716.823756] kmemleak: backtrace: [ 716.823760] pcpu_alloc_noprof+0x87a/0x1170 [ 716.823776] percpu_ref_init+0x37/0x400 [ 716.823787] io_uring_setup+0x44c/0x2000 [ 716.823799] __x64_sys_io_uring_setup+0xc8/0x170 [ 716.823811] do_syscall_64+0xbf/0x360 [ 716.823820] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:01 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:01 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:01 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:01 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:01 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) 23:30:01 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x0, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:01 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:01 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 726.346411] kmemleak: Found object by alias at 0x607f1a63e894 [ 726.346437] CPU: 1 UID: 0 PID: 8569 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 726.346461] Tainted: [W]=WARN [ 726.346465] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 726.346474] Call Trace: [ 726.346479] [ 726.346485] dump_stack_lvl+0xca/0x120 [ 726.346516] __lookup_object+0x94/0xb0 [ 726.346538] delete_object_full+0x27/0x70 [ 726.346558] free_percpu+0x30/0x1160 [ 726.346584] ? arch_uprobe_clear_state+0x16/0x140 [ 726.346610] futex_hash_free+0x38/0xc0 [ 726.346628] mmput+0x2d3/0x390 [ 726.346652] do_exit+0x79d/0x2970 [ 726.346669] ? lock_release+0xc8/0x290 [ 726.346689] ? __pfx_do_exit+0x10/0x10 [ 726.346707] ? find_held_lock+0x2b/0x80 [ 726.346729] ? get_signal+0x835/0x2340 [ 726.346755] do_group_exit+0xd3/0x2a0 [ 726.346774] get_signal+0x2315/0x2340 [ 726.346803] ? __pfx_get_signal+0x10/0x10 [ 726.346824] ? do_futex+0x135/0x370 [ 726.346841] ? __pfx_do_futex+0x10/0x10 [ 726.346860] arch_do_signal_or_restart+0x80/0x790 [ 726.346882] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 726.346903] ? __x64_sys_futex+0x1c9/0x4d0 [ 726.346919] ? __x64_sys_futex+0x1d2/0x4d0 [ 726.346938] ? __pfx___x64_sys_futex+0x10/0x10 [ 726.346955] ? fd_install+0x1f0/0x660 [ 726.346984] exit_to_user_mode_loop+0x8b/0x110 [ 726.347000] do_syscall_64+0x2f7/0x360 [ 726.347016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.347031] RIP: 0033:0x7f5141970b19 [ 726.347043] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 726.347049] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 726.347064] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 726.347074] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 726.347082] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 726.347091] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 726.347100] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 726.347119] [ 726.347124] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 726.347132] kmemleak: comm "syz-executor.5", pid 8567, jiffies 4295393215 [ 726.347141] kmemleak: min_count = 1 [ 726.347146] kmemleak: count = 0 [ 726.347151] kmemleak: flags = 0x21 [ 726.347155] kmemleak: checksum = 0 [ 726.347160] kmemleak: backtrace: [ 726.347164] pcpu_alloc_noprof+0x87a/0x1170 [ 726.347184] percpu_ref_init+0x37/0x400 [ 726.347197] io_uring_setup+0x44c/0x2000 [ 726.347211] __x64_sys_io_uring_setup+0xc8/0x170 [ 726.347226] do_syscall_64+0xbf/0x360 [ 726.347238] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:01 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:01 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:01 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:01 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:01 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x0, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:01 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:01 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:01 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:01 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:01 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:02 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:02 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:02 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 726.758711] kmemleak: Found object by alias at 0x607f1a63e26c [ 726.758744] CPU: 0 UID: 0 PID: 8591 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 726.758780] Tainted: [W]=WARN [ 726.758787] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 726.758801] Call Trace: [ 726.758808] [ 726.758817] dump_stack_lvl+0xca/0x120 [ 726.758861] __lookup_object+0x94/0xb0 [ 726.758893] delete_object_full+0x27/0x70 [ 726.758926] free_percpu+0x30/0x1160 [ 726.758958] ? arch_uprobe_clear_state+0x16/0x140 [ 726.759010] futex_hash_free+0x38/0xc0 [ 726.759037] mmput+0x2d3/0x390 [ 726.759074] do_exit+0x79d/0x2970 [ 726.759101] ? signal_wake_up_state+0x85/0x120 [ 726.759132] ? zap_other_threads+0x2b9/0x3a0 [ 726.759164] ? __pfx_do_exit+0x10/0x10 [ 726.759190] ? do_group_exit+0x1c3/0x2a0 [ 726.759218] ? lock_release+0xc8/0x290 [ 726.759251] do_group_exit+0xd3/0x2a0 [ 726.759281] __x64_sys_exit_group+0x3e/0x50 [ 726.759309] x64_sys_call+0x18c5/0x18d0 [ 726.759340] do_syscall_64+0xbf/0x360 [ 726.759364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.759388] RIP: 0033:0x7fcf751aeb19 [ 726.759411] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 726.759422] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 726.759444] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 726.759460] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 726.759474] RBP: 0000000000000000 R08: 0000001b2d023b24 R09: 0000000000000000 [ 726.759488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.759501] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 726.759532] [ 726.759539] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 726.759552] kmemleak: comm "syz-executor.6", pid 8612, jiffies 4295393636 [ 726.759566] kmemleak: min_count = 1 [ 726.759574] kmemleak: count = 0 [ 726.759581] kmemleak: flags = 0x21 [ 726.759589] kmemleak: checksum = 0 [ 726.759596] kmemleak: backtrace: [ 726.759602] pcpu_alloc_noprof+0x87a/0x1170 [ 726.759634] percpu_ref_init+0x37/0x400 [ 726.759653] io_uring_setup+0x44c/0x2000 [ 726.759676] __x64_sys_io_uring_setup+0xc8/0x170 [ 726.759700] do_syscall_64+0xbf/0x360 [ 726.759719] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:02 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) 23:30:02 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x0, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:02 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000009c0)={@ipv4={""/10, ""/2, @multicast1}}, &(0x7f0000000a00)=0x14) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:02 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:02 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:02 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:14 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:14 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r3 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:14 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 7: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') 23:30:14 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:14 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 739.393962] kmemleak: Found object by alias at 0x607f1a63e894 [ 739.393984] CPU: 1 UID: 0 PID: 8654 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 739.394002] Tainted: [W]=WARN [ 739.394006] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 739.394013] Call Trace: [ 739.394018] [ 739.394023] dump_stack_lvl+0xca/0x120 [ 739.394049] __lookup_object+0x94/0xb0 [ 739.394067] delete_object_full+0x27/0x70 [ 739.394084] free_percpu+0x30/0x1160 [ 739.394101] ? arch_uprobe_clear_state+0x16/0x140 [ 739.394122] futex_hash_free+0x38/0xc0 [ 739.394136] mmput+0x2d3/0x390 [ 739.394156] do_exit+0x79d/0x2970 [ 739.394173] ? __pfx_do_exit+0x10/0x10 [ 739.394187] ? find_held_lock+0x2b/0x80 [ 739.394206] ? get_signal+0x835/0x2340 [ 739.394227] do_group_exit+0xd3/0x2a0 [ 739.394242] get_signal+0x2315/0x2340 [ 739.394260] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 739.394277] ? __pfx_get_signal+0x10/0x10 [ 739.394293] ? __schedule+0xe91/0x3590 [ 739.394314] arch_do_signal_or_restart+0x80/0x790 [ 739.394332] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 739.394349] ? __x64_sys_futex+0x1c9/0x4d0 [ 739.394361] ? __x64_sys_futex+0x1d2/0x4d0 [ 739.394375] ? __x64_sys_openat+0x142/0x200 [ 739.394393] ? __pfx___x64_sys_futex+0x10/0x10 [ 739.394407] ? xfd_validate_state+0x55/0x180 [ 739.394428] exit_to_user_mode_loop+0x8b/0x110 [ 739.394441] do_syscall_64+0x2f7/0x360 [ 739.394454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.394466] RIP: 0033:0x7f5141970b19 [ 739.394476] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 739.394481] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 739.394493] RAX: 0000000000000001 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 739.394501] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5141a83f6c [ 739.394508] RBP: 00007f5141a83f60 R08: 000000000000000d R09: 0000000000000000 [ 739.394515] R10: 0000000000000004 R11: 0000000000000246 R12: 00007f5141a83f6c [ 739.394522] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 739.394537] [ 739.394541] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 739.394548] kmemleak: comm "syz-executor.4", pid 8659, jiffies 4295406300 [ 739.394555] kmemleak: min_count = 1 [ 739.394559] kmemleak: count = 0 [ 739.394562] kmemleak: flags = 0x21 [ 739.394566] kmemleak: checksum = 0 [ 739.394575] kmemleak: backtrace: [ 739.394578] pcpu_alloc_noprof+0x87a/0x1170 [ 739.394594] percpu_ref_init+0x37/0x400 [ 739.394605] io_uring_setup+0x44c/0x2000 [ 739.394617] __x64_sys_io_uring_setup+0xc8/0x170 [ 739.394629] do_syscall_64+0xbf/0x360 [ 739.394638] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:14 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:14 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:14 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) [ 739.511573] kmemleak: Found object by alias at 0x607f1a63e26c 23:30:14 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:14 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') [ 739.511593] CPU: 1 UID: 0 PID: 8659 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 739.511612] Tainted: [W]=WARN [ 739.511616] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 739.511623] Call Trace: [ 739.511628] [ 739.511633] dump_stack_lvl+0xca/0x120 [ 739.511659] __lookup_object+0x94/0xb0 [ 739.511677] delete_object_full+0x27/0x70 [ 739.511694] free_percpu+0x30/0x1160 [ 739.511711] ? arch_uprobe_clear_state+0x16/0x140 [ 739.511732] futex_hash_free+0x38/0xc0 [ 739.511747] mmput+0x2d3/0x390 [ 739.511767] do_exit+0x79d/0x2970 [ 739.511784] ? __pfx_do_exit+0x10/0x10 [ 739.511799] ? find_held_lock+0x2b/0x80 [ 739.511817] ? get_signal+0x835/0x2340 [ 739.511837] do_group_exit+0xd3/0x2a0 [ 739.511852] get_signal+0x2315/0x2340 [ 739.511875] ? __pfx_get_signal+0x10/0x10 [ 739.511892] ? do_futex+0x135/0x370 [ 739.511905] ? __pfx_do_futex+0x10/0x10 [ 739.511920] arch_do_signal_or_restart+0x80/0x790 [ 739.511939] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 739.511955] ? __x64_sys_futex+0x1c9/0x4d0 [ 739.511968] ? __x64_sys_futex+0x1d2/0x4d0 [ 739.511983] ? __pfx___x64_sys_futex+0x10/0x10 [ 739.511997] ? xfd_validate_state+0x55/0x180 [ 739.512018] exit_to_user_mode_loop+0x8b/0x110 [ 739.512031] do_syscall_64+0x2f7/0x360 [ 739.512044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.512056] RIP: 0033:0x7fcf751aeb19 [ 739.512065] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 739.512070] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 739.512082] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 739.512090] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 739.512097] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 739.512104] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 739.512111] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 739.512126] [ 739.512130] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 739.512137] kmemleak: comm "syz-executor.1", pid 8667, jiffies 4295406422 [ 739.512144] kmemleak: min_count = 1 [ 739.512147] kmemleak: count = 0 [ 739.512151] kmemleak: flags = 0x21 [ 739.512155] kmemleak: checksum = 0 [ 739.512158] kmemleak: backtrace: [ 739.512162] pcpu_alloc_noprof+0x87a/0x1170 [ 739.512177] percpu_ref_init+0x37/0x400 [ 739.512188] io_uring_setup+0x44c/0x2000 [ 739.512200] __x64_sys_io_uring_setup+0xc8/0x170 [ 739.512212] do_syscall_64+0xbf/0x360 [ 739.512221] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:15 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:24 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:24 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:24 executing program 7: syz_open_procfs(0x0, 0x0) 23:30:24 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r0, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:24 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:24 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:24 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:24 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:24 executing program 7: syz_open_procfs(0x0, 0x0) [ 749.393249] kmemleak: Found object by alias at 0x607f1a63e26c [ 749.393278] CPU: 1 UID: 0 PID: 8700 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 749.393311] Tainted: [W]=WARN [ 749.393318] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 749.393331] Call Trace: 23:30:24 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) [ 749.393338] [ 749.393347] dump_stack_lvl+0xca/0x120 [ 749.393394] __lookup_object+0x94/0xb0 [ 749.393425] delete_object_full+0x27/0x70 [ 749.393456] free_percpu+0x30/0x1160 [ 749.393487] ? arch_uprobe_clear_state+0x16/0x140 [ 749.393524] futex_hash_free+0x38/0xc0 [ 749.393550] mmput+0x2d3/0x390 [ 749.393593] do_exit+0x79d/0x2970 [ 749.393626] ? __pfx_do_exit+0x10/0x10 [ 749.393653] ? find_held_lock+0x2b/0x80 [ 749.393686] ? get_signal+0x835/0x2340 [ 749.393723] do_group_exit+0xd3/0x2a0 [ 749.393751] get_signal+0x2315/0x2340 [ 749.393794] ? __pfx_get_signal+0x10/0x10 [ 749.393825] ? do_futex+0x135/0x370 [ 749.393851] ? __pfx_do_futex+0x10/0x10 [ 749.393879] arch_do_signal_or_restart+0x80/0x790 [ 749.393912] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 749.393943] ? __x64_sys_futex+0x1c9/0x4d0 [ 749.393966] ? __x64_sys_futex+0x1d2/0x4d0 [ 749.393995] ? __pfx___x64_sys_futex+0x10/0x10 [ 749.394020] ? xfd_validate_state+0x55/0x180 [ 749.394059] exit_to_user_mode_loop+0x8b/0x110 [ 749.394083] do_syscall_64+0x2f7/0x360 [ 749.394107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.394129] RIP: 0033:0x7fcf751aeb19 [ 749.394145] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 749.394155] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 749.394176] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 749.394191] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 749.394204] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 749.394217] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 749.394230] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 749.394259] [ 749.394267] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 749.394279] kmemleak: comm "syz-executor.1", pid 8707, jiffies 4295416262 [ 749.394292] kmemleak: min_count = 1 [ 749.394299] kmemleak: count = 0 [ 749.394306] kmemleak: flags = 0x21 [ 749.394313] kmemleak: checksum = 0 [ 749.394320] kmemleak: backtrace: [ 749.394326] pcpu_alloc_noprof+0x87a/0x1170 [ 749.394355] percpu_ref_init+0x37/0x400 [ 749.394374] io_uring_setup+0x44c/0x2000 [ 749.394396] __x64_sys_io_uring_setup+0xc8/0x170 [ 749.394418] do_syscall_64+0xbf/0x360 [ 749.394435] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:30:24 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:24 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:24 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:24 executing program 7: syz_open_procfs(0x0, 0x0) 23:30:25 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:25 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:35 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:30:35 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(0x0, r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:35 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:35 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:35 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:35 executing program 0: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:35 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:35 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, &(0x7f0000000500)) [ 759.791882] kmemleak: Found object by alias at 0x607f1a63e26c [ 759.791906] CPU: 1 UID: 0 PID: 8753 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 759.791926] Tainted: [W]=WARN [ 759.791931] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 759.791939] Call Trace: [ 759.791943] [ 759.791949] dump_stack_lvl+0xca/0x120 [ 759.791978] __lookup_object+0x94/0xb0 [ 759.791999] delete_object_full+0x27/0x70 [ 759.792017] free_percpu+0x30/0x1160 [ 759.792037] ? arch_uprobe_clear_state+0x16/0x140 [ 759.792061] futex_hash_free+0x38/0xc0 [ 759.792077] mmput+0x2d3/0x390 [ 759.792099] do_exit+0x79d/0x2970 [ 759.792119] ? __pfx_do_exit+0x10/0x10 [ 759.792141] ? find_held_lock+0x2b/0x80 [ 759.792162] ? get_signal+0x835/0x2340 [ 759.792185] do_group_exit+0xd3/0x2a0 [ 759.792202] get_signal+0x2315/0x2340 [ 759.792223] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 759.792243] ? __pfx_get_signal+0x10/0x10 [ 759.792262] ? do_futex+0x135/0x370 [ 759.792278] ? __pfx_do_futex+0x10/0x10 [ 759.792295] arch_do_signal_or_restart+0x80/0x790 [ 759.792316] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 759.792335] ? __x64_sys_futex+0x1c9/0x4d0 [ 759.792349] ? __x64_sys_futex+0x1d2/0x4d0 [ 759.792367] ? __pfx___x64_sys_futex+0x10/0x10 [ 759.792382] ? xfd_validate_state+0x55/0x180 [ 759.792406] exit_to_user_mode_loop+0x8b/0x110 [ 759.792421] do_syscall_64+0x2f7/0x360 [ 759.792436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.792450] RIP: 0033:0x7fcf751aeb19 [ 759.792460] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 759.792466] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 759.792479] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 759.792488] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 759.792496] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 759.792504] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 759.792512] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 759.792530] [ 759.792535] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 759.792543] kmemleak: comm "syz-executor.1", pid 8758, jiffies 4295426707 [ 759.792551] kmemleak: min_count = 1 [ 759.792555] kmemleak: count = 0 [ 759.792559] kmemleak: flags = 0x21 [ 759.792564] kmemleak: checksum = 0 [ 759.792568] kmemleak: backtrace: [ 759.792572] pcpu_alloc_noprof+0x87a/0x1170 [ 759.792590] percpu_ref_init+0x37/0x400 [ 759.792602] io_uring_setup+0x44c/0x2000 [ 759.792616] __x64_sys_io_uring_setup+0xc8/0x170 [ 759.792629] do_syscall_64+0xbf/0x360 [ 759.792642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.321963] kworker/u9:4 (331) used greatest stack depth: 24400 bytes left 23:30:44 executing program 0: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:44 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, &(0x7f0000000500)) 23:30:44 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:44 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:44 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(0x0, r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:44 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:44 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:44 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:44 executing program 0: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:45 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:45 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:45 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:45 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:45 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, &(0x7f0000000500)) 23:30:45 executing program 0: io_uring_setup(0x1d74, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:53 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:53 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), 0x0) 23:30:53 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:53 executing program 4: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:30:53 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(0x0, r2) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:30:53 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:53 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:53 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:53 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), 0x0) 23:30:53 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:53 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:30:53 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, 0x0, &(0x7f0000000240)) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:30:53 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:02 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 4: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:02 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:02 executing program 2: io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) eventfd2(0x0, 0x0) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x0, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), 0x0) 23:31:02 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:31:02 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, 0x0, &(0x7f0000000240)) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 787.169849] kmemleak: Found object by alias at 0x607f1a63e26c [ 787.169882] CPU: 0 UID: 0 PID: 8848 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 787.169918] Tainted: [W]=WARN [ 787.169925] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 787.169939] Call Trace: [ 787.169947] [ 787.169956] dump_stack_lvl+0xca/0x120 [ 787.170005] __lookup_object+0x94/0xb0 [ 787.170038] delete_object_full+0x27/0x70 [ 787.170071] free_percpu+0x30/0x1160 [ 787.170103] ? arch_uprobe_clear_state+0x16/0x140 [ 787.170143] futex_hash_free+0x38/0xc0 [ 787.170171] mmput+0x2d3/0x390 [ 787.170208] do_exit+0x79d/0x2970 [ 787.170235] ? signal_wake_up_state+0x85/0x120 [ 787.170268] ? zap_other_threads+0x2b9/0x3a0 [ 787.170301] ? __pfx_do_exit+0x10/0x10 [ 787.170327] ? do_group_exit+0x1c3/0x2a0 [ 787.170355] ? lock_release+0xc8/0x290 [ 787.170389] do_group_exit+0xd3/0x2a0 [ 787.170419] __x64_sys_exit_group+0x3e/0x50 [ 787.170448] x64_sys_call+0x18c5/0x18d0 [ 787.170479] do_syscall_64+0xbf/0x360 [ 787.170504] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.170528] RIP: 0033:0x7fcf751aeb19 [ 787.170545] Code: Unable to access opcode bytes at 0x7fcf751aeaef. 23:31:02 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) [ 787.170556] RSP: 002b:00007fff13acdb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 787.170587] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fcf751aeb19 [ 787.170602] RDX: 00007fcf7516172b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 787.170617] RBP: 0000000000000000 R08: 0000001b2d023b3c R09: 0000000000000000 [ 787.170631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 787.170644] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff13acdc80 [ 787.170675] [ 787.170683] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 787.170696] kmemleak: comm "syz-executor.6", pid 8858, jiffies 4295454073 [ 787.170710] kmemleak: min_count = 1 [ 787.170718] kmemleak: count = 0 [ 787.170725] kmemleak: flags = 0x21 [ 787.170733] kmemleak: checksum = 0 [ 787.170740] kmemleak: backtrace: [ 787.170747] pcpu_alloc_noprof+0x87a/0x1170 [ 787.170778] percpu_ref_init+0x37/0x400 [ 787.170798] io_uring_setup+0x44c/0x2000 [ 787.170821] __x64_sys_io_uring_setup+0xc8/0x170 [ 787.170844] do_syscall_64+0xbf/0x360 [ 787.170864] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:02 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:02 executing program 4: r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:02 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, 0x0, &(0x7f0000000240)) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) socket$packet(0x11, 0x2, 0x300) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:02 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:02 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 787.532940] kmemleak: Found object by alias at 0x607f1a63e894 [ 787.532971] CPU: 0 UID: 0 PID: 8878 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 787.533007] Tainted: [W]=WARN [ 787.533015] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 787.533029] Call Trace: [ 787.533036] [ 787.533045] dump_stack_lvl+0xca/0x120 [ 787.533096] __lookup_object+0x94/0xb0 [ 787.533129] delete_object_full+0x27/0x70 [ 787.533162] free_percpu+0x30/0x1160 [ 787.533194] ? arch_uprobe_clear_state+0x16/0x140 [ 787.533234] futex_hash_free+0x38/0xc0 [ 787.533261] mmput+0x2d3/0x390 [ 787.533298] do_exit+0x79d/0x2970 [ 787.533333] ? __pfx_do_exit+0x10/0x10 [ 787.533362] ? find_held_lock+0x2b/0x80 [ 787.533397] ? get_signal+0x835/0x2340 [ 787.533437] do_group_exit+0xd3/0x2a0 [ 787.533467] get_signal+0x2315/0x2340 [ 787.533503] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 787.533537] ? __pfx_get_signal+0x10/0x10 [ 787.533570] ? __schedule+0xe91/0x3590 [ 787.533611] arch_do_signal_or_restart+0x80/0x790 [ 787.533646] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 787.533679] ? __x64_sys_futex+0x1c9/0x4d0 [ 787.533704] ? __x64_sys_futex+0x1d2/0x4d0 [ 787.533735] ? __pfx___x64_sys_futex+0x10/0x10 [ 787.533760] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 787.533797] exit_to_user_mode_loop+0x8b/0x110 [ 787.533823] do_syscall_64+0x2f7/0x360 [ 787.533848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.533871] RIP: 0033:0x7f5141970b19 [ 787.533889] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 787.533899] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 787.533921] RAX: 0000000000000001 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 787.533937] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5141a83f6c [ 787.533951] RBP: 00007f5141a83f60 R08: 0000000000000016 R09: 0000000000000000 [ 787.533966] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f5141a83f6c [ 787.533982] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 787.534013] [ 787.534020] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 787.534034] kmemleak: comm "syz-executor.5", pid 8885, jiffies 4295454396 [ 787.534048] kmemleak: min_count = 1 [ 787.534056] kmemleak: count = 0 [ 787.534063] kmemleak: flags = 0x21 [ 787.534070] kmemleak: checksum = 0 [ 787.534078] kmemleak: backtrace: [ 787.534084] pcpu_alloc_noprof+0x87a/0x1170 [ 787.534115] percpu_ref_init+0x37/0x400 [ 787.534135] io_uring_setup+0x44c/0x2000 [ 787.534158] __x64_sys_io_uring_setup+0xc8/0x170 [ 787.534181] do_syscall_64+0xbf/0x360 [ 787.534200] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:12 executing program 7: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x0, 0x18c}) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:12 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:12 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:12 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, 0x0) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:12 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:12 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:12 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r3, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:31:12 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:12 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:13 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:13 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, 0x0) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:13 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:13 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:31:13 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:13 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:13 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:13 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') [ 797.770002] kmemleak: Found object by alias at 0x607f1a63e26c [ 797.770023] CPU: 1 UID: 0 PID: 8941 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 797.770041] Tainted: [W]=WARN [ 797.770045] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 797.770052] Call Trace: [ 797.770056] [ 797.770061] dump_stack_lvl+0xca/0x120 [ 797.770088] __lookup_object+0x94/0xb0 [ 797.770110] delete_object_full+0x27/0x70 [ 797.770126] free_percpu+0x30/0x1160 [ 797.770143] ? arch_uprobe_clear_state+0x16/0x140 [ 797.770164] futex_hash_free+0x38/0xc0 [ 797.770178] mmput+0x2d3/0x390 [ 797.770197] do_exit+0x79d/0x2970 [ 797.770215] ? __pfx_do_exit+0x10/0x10 [ 797.770230] ? find_held_lock+0x2b/0x80 [ 797.770248] ? get_signal+0x835/0x2340 [ 797.770268] do_group_exit+0xd3/0x2a0 [ 797.770283] get_signal+0x2315/0x2340 [ 797.770301] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 797.770319] ? __pfx_get_signal+0x10/0x10 [ 797.770335] ? do_futex+0x135/0x370 [ 797.770349] ? __pfx_do_futex+0x10/0x10 [ 797.770364] arch_do_signal_or_restart+0x80/0x790 [ 797.770382] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 797.770399] ? __x64_sys_futex+0x1c9/0x4d0 [ 797.770411] ? __x64_sys_futex+0x1d2/0x4d0 [ 797.770426] ? __pfx___x64_sys_futex+0x10/0x10 [ 797.770440] ? xfd_validate_state+0x55/0x180 [ 797.770461] exit_to_user_mode_loop+0x8b/0x110 [ 797.770474] do_syscall_64+0x2f7/0x360 [ 797.770487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.770500] RIP: 0033:0x7fcf751aeb19 [ 797.770509] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 797.770514] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 797.770526] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 797.770533] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 797.770540] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 797.770547] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 797.770554] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 797.770570] [ 797.770574] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 797.770581] kmemleak: comm "syz-executor.7", pid 8943, jiffies 4295464680 [ 797.770588] kmemleak: min_count = 1 [ 797.770591] kmemleak: count = 0 [ 797.770595] kmemleak: flags = 0x21 [ 797.770599] kmemleak: checksum = 0 [ 797.770603] kmemleak: backtrace: [ 797.770606] pcpu_alloc_noprof+0x87a/0x1170 [ 797.770622] percpu_ref_init+0x37/0x400 [ 797.770632] io_uring_setup+0x44c/0x2000 [ 797.770644] __x64_sys_io_uring_setup+0xc8/0x170 [ 797.770656] do_syscall_64+0xbf/0x360 [ 797.770665] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:22 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') 23:31:22 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x0, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:22 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:22 executing program 7: r0 = syz_open_procfs(0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:22 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x44040855}, 0x20000004) 23:31:22 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:22 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:22 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, 0x0) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 807.329732] kmemleak: Found object by alias at 0x607f1a63e26c [ 807.329755] CPU: 1 UID: 0 PID: 8965 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 807.329777] Tainted: [W]=WARN [ 807.329781] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 807.329788] Call Trace: [ 807.329793] [ 807.329798] dump_stack_lvl+0xca/0x120 [ 807.329825] __lookup_object+0x94/0xb0 [ 807.329843] delete_object_full+0x27/0x70 [ 807.329860] free_percpu+0x30/0x1160 [ 807.329877] ? arch_uprobe_clear_state+0x16/0x140 [ 807.329898] futex_hash_free+0x38/0xc0 [ 807.329913] mmput+0x2d3/0x390 [ 807.329933] do_exit+0x79d/0x2970 [ 807.329951] ? __pfx_do_exit+0x10/0x10 [ 807.329965] ? find_held_lock+0x2b/0x80 [ 807.329984] ? get_signal+0x835/0x2340 [ 807.330005] do_group_exit+0xd3/0x2a0 [ 807.330021] get_signal+0x2315/0x2340 [ 807.330039] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 807.330057] ? __pfx_get_signal+0x10/0x10 [ 807.330074] ? do_futex+0x135/0x370 [ 807.330088] ? __pfx_do_futex+0x10/0x10 [ 807.330104] arch_do_signal_or_restart+0x80/0x790 [ 807.330122] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 807.330139] ? __x64_sys_futex+0x1c9/0x4d0 [ 807.330152] ? __x64_sys_futex+0x1d2/0x4d0 [ 807.330167] ? __pfx___x64_sys_futex+0x10/0x10 [ 807.330182] ? xfd_validate_state+0x55/0x180 [ 807.330203] exit_to_user_mode_loop+0x8b/0x110 [ 807.330217] do_syscall_64+0x2f7/0x360 [ 807.330230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.330242] RIP: 0033:0x7fcf751aeb19 [ 807.330252] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 807.330257] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 807.330269] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 807.330277] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 807.330284] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 807.330291] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 807.330299] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 807.330314] [ 807.330318] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 807.330325] kmemleak: comm "syz-executor.1", pid 8974, jiffies 4295474224 [ 807.330333] kmemleak: min_count = 1 [ 807.330337] kmemleak: count = 0 [ 807.330340] kmemleak: flags = 0x21 [ 807.330344] kmemleak: checksum = 0 [ 807.330348] kmemleak: backtrace: [ 807.330352] pcpu_alloc_noprof+0x87a/0x1170 [ 807.330368] percpu_ref_init+0x37/0x400 [ 807.330379] io_uring_setup+0x44c/0x2000 [ 807.330391] __x64_sys_io_uring_setup+0xc8/0x170 [ 807.330403] do_syscall_64+0xbf/0x360 [ 807.330413] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:22 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:22 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:22 executing program 7: r0 = syz_open_procfs(0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:22 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) 23:31:22 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:22 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:22 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x20000004) 23:31:22 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:23 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:30 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:30 executing program 7: r0 = syz_open_procfs(0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:30 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:30 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:30 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:30 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:30 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x0) 23:31:30 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:30 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:31 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) [ 815.665520] kmemleak: Found object by alias at 0x607f1a63e894 [ 815.665542] CPU: 1 UID: 0 PID: 9029 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 815.665560] Tainted: [W]=WARN [ 815.665564] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 815.665576] Call Trace: [ 815.665580] [ 815.665585] dump_stack_lvl+0xca/0x120 [ 815.665611] __lookup_object+0x94/0xb0 [ 815.665629] delete_object_full+0x27/0x70 [ 815.665645] free_percpu+0x30/0x1160 [ 815.665662] ? arch_uprobe_clear_state+0x16/0x140 [ 815.665682] futex_hash_free+0x38/0xc0 [ 815.665697] mmput+0x2d3/0x390 [ 815.665716] do_exit+0x79d/0x2970 [ 815.665730] ? lock_release+0xc8/0x290 [ 815.665746] ? __pfx_do_exit+0x10/0x10 [ 815.665760] ? find_held_lock+0x2b/0x80 [ 815.665778] ? get_signal+0x835/0x2340 [ 815.665798] do_group_exit+0xd3/0x2a0 [ 815.665813] get_signal+0x2315/0x2340 [ 815.665831] ? __pfx_signal_setup_done+0x10/0x10 [ 815.665852] ? __pfx_get_signal+0x10/0x10 [ 815.665869] ? do_futex+0x135/0x370 [ 815.665882] ? __pfx_do_futex+0x10/0x10 [ 815.665895] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 815.665910] arch_do_signal_or_restart+0x80/0x790 [ 815.665928] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 815.665944] ? __x64_sys_futex+0x1c9/0x4d0 [ 815.665957] ? __x64_sys_futex+0x1d2/0x4d0 [ 815.665972] ? __pfx___x64_sys_futex+0x10/0x10 [ 815.665985] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 815.666003] exit_to_user_mode_loop+0x8b/0x110 [ 815.666016] do_syscall_64+0x2f7/0x360 [ 815.666029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.666041] RIP: 0033:0x7f5141970b19 [ 815.666050] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 815.666056] RSP: 002b:00007f513eee6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 815.666068] RAX: fffffffffffffe00 RBX: 00007f5141a83f68 RCX: 00007f5141970b19 [ 815.666076] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5141a83f68 [ 815.666083] RBP: 00007f5141a83f60 R08: 0000000000000000 R09: 0000000000000000 [ 815.666089] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5141a83f6c [ 815.666096] R13: 00007ffef881168f R14: 00007f513eee6300 R15: 0000000000022000 [ 815.666112] [ 815.666116] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 815.666122] kmemleak: comm "syz-executor.6", pid 9028, jiffies 4295482584 [ 815.666130] kmemleak: min_count = 1 [ 815.666133] kmemleak: count = 0 [ 815.666137] kmemleak: flags = 0x21 [ 815.666141] kmemleak: checksum = 0 [ 815.666145] kmemleak: backtrace: [ 815.666148] pcpu_alloc_noprof+0x87a/0x1170 [ 815.666164] percpu_ref_init+0x37/0x400 [ 815.666175] io_uring_setup+0x44c/0x2000 [ 815.666186] __x64_sys_io_uring_setup+0xc8/0x170 [ 815.666198] do_syscall_64+0xbf/0x360 [ 815.666207] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:31 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:31 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:31 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:31 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:39 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:39 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x0) 23:31:39 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:39 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:39 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:39 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:39 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:39 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:39 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:39 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) [ 824.298534] kmemleak: Found object by alias at 0x607f1a63e894 [ 824.298566] CPU: 0 UID: 0 PID: 9063 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 824.298607] Tainted: [W]=WARN [ 824.298613] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 824.298626] Call Trace: [ 824.298634] [ 824.298642] dump_stack_lvl+0xca/0x120 [ 824.298685] __lookup_object+0x94/0xb0 [ 824.298715] delete_object_full+0x27/0x70 [ 824.298746] free_percpu+0x30/0x1160 [ 824.298777] ? arch_uprobe_clear_state+0x16/0x140 [ 824.298813] futex_hash_free+0x38/0xc0 [ 824.298839] mmput+0x2d3/0x390 [ 824.298874] do_exit+0x79d/0x2970 [ 824.298900] ? signal_wake_up_state+0x85/0x120 [ 824.298929] ? zap_other_threads+0x2b9/0x3a0 [ 824.298959] ? __pfx_do_exit+0x10/0x10 [ 824.298984] ? do_group_exit+0x1c3/0x2a0 [ 824.299010] ? lock_release+0xc8/0x290 [ 824.299040] do_group_exit+0xd3/0x2a0 [ 824.299069] __x64_sys_exit_group+0x3e/0x50 [ 824.299096] x64_sys_call+0x18c5/0x18d0 [ 824.299124] do_syscall_64+0xbf/0x360 [ 824.299148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.299169] RIP: 0033:0x7f5141970b19 [ 824.299185] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 824.299195] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 824.299216] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 824.299231] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 824.299244] RBP: 0000000000000000 R08: 0000001b2d12200c R09: 0000000000000000 [ 824.299257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 824.299270] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 824.299298] [ 824.299305] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 824.299318] kmemleak: comm "syz-executor.6", pid 9068, jiffies 4295491187 [ 824.299331] kmemleak: min_count = 1 [ 824.299338] kmemleak: count = 0 [ 824.299345] kmemleak: flags = 0x21 [ 824.299352] kmemleak: checksum = 0 [ 824.299359] kmemleak: backtrace: [ 824.299365] pcpu_alloc_noprof+0x87a/0x1170 [ 824.299395] percpu_ref_init+0x37/0x400 [ 824.299413] io_uring_setup+0x44c/0x2000 [ 824.299435] __x64_sys_io_uring_setup+0xc8/0x170 [ 824.299457] do_syscall_64+0xbf/0x360 [ 824.299475] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:39 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:39 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'vxcan1\x00'}) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000740)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, 0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) socketpair(0x8, 0x0, 0x0, &(0x7f00000008c0)) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000000a00)) syz_genetlink_get_family_id$batadv(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x0) 23:31:39 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:39 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:48 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, 0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:48 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:48 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:48 executing program 3: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:48 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:48 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) [ 833.296287] kmemleak: Found object by alias at 0x607f1a63e26c [ 833.296319] CPU: 1 UID: 0 PID: 9103 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 833.296338] Tainted: [W]=WARN [ 833.296342] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 833.296350] Call Trace: [ 833.296354] [ 833.296359] dump_stack_lvl+0xca/0x120 [ 833.296394] __lookup_object+0x94/0xb0 [ 833.296413] delete_object_full+0x27/0x70 [ 833.296430] free_percpu+0x30/0x1160 [ 833.296447] ? arch_uprobe_clear_state+0x16/0x140 [ 833.296468] futex_hash_free+0x38/0xc0 [ 833.296484] mmput+0x2d3/0x390 [ 833.296508] do_exit+0x79d/0x2970 [ 833.296526] ? __pfx_do_exit+0x10/0x10 [ 833.296540] ? find_held_lock+0x2b/0x80 [ 833.296559] ? get_signal+0x835/0x2340 [ 833.296581] do_group_exit+0xd3/0x2a0 [ 833.296596] get_signal+0x2315/0x2340 [ 833.296619] ? __pfx_get_signal+0x10/0x10 [ 833.296635] ? do_futex+0x135/0x370 [ 833.296649] ? __pfx_do_futex+0x10/0x10 [ 833.296664] arch_do_signal_or_restart+0x80/0x790 [ 833.296683] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 833.296700] ? __x64_sys_futex+0x1c9/0x4d0 [ 833.296712] ? __x64_sys_futex+0x1d2/0x4d0 [ 833.296728] ? __pfx___x64_sys_futex+0x10/0x10 [ 833.296742] ? xfd_validate_state+0x55/0x180 [ 833.296764] exit_to_user_mode_loop+0x8b/0x110 [ 833.296777] do_syscall_64+0x2f7/0x360 [ 833.296791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.296804] RIP: 0033:0x7fcf751aeb19 [ 833.296813] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 833.296819] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 833.296830] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 833.296838] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 833.296846] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 833.296853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 833.296860] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 833.296875] [ 833.296879] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 833.296886] kmemleak: comm "syz-executor.6", pid 9111, jiffies 4295500193 [ 833.296893] kmemleak: min_count = 1 [ 833.296897] kmemleak: count = 0 [ 833.296901] kmemleak: flags = 0x21 [ 833.296905] kmemleak: checksum = 0 [ 833.296909] kmemleak: backtrace: [ 833.296912] pcpu_alloc_noprof+0x87a/0x1170 [ 833.296928] percpu_ref_init+0x37/0x400 [ 833.296939] io_uring_setup+0x44c/0x2000 [ 833.296952] __x64_sys_io_uring_setup+0xc8/0x170 [ 833.296964] do_syscall_64+0xbf/0x360 [ 833.296973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.308695] kmemleak: Found object by alias at 0x607f1a63e894 [ 833.308727] CPU: 0 UID: 0 PID: 9100 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 833.308760] Tainted: [W]=WARN [ 833.308767] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 833.308780] Call Trace: [ 833.308787] [ 833.308796] dump_stack_lvl+0xca/0x120 [ 833.308838] __lookup_object+0x94/0xb0 [ 833.308869] delete_object_full+0x27/0x70 [ 833.308900] free_percpu+0x30/0x1160 [ 833.308931] ? arch_uprobe_clear_state+0x16/0x140 [ 833.308967] futex_hash_free+0x38/0xc0 [ 833.308993] mmput+0x2d3/0x390 [ 833.309028] do_exit+0x79d/0x2970 [ 833.309054] ? signal_wake_up_state+0x85/0x120 [ 833.309083] ? zap_other_threads+0x2b9/0x3a0 [ 833.309113] ? __pfx_do_exit+0x10/0x10 [ 833.309137] ? do_group_exit+0x1c3/0x2a0 [ 833.309163] ? lock_release+0xc8/0x290 [ 833.309194] do_group_exit+0xd3/0x2a0 [ 833.309222] __x64_sys_exit_group+0x3e/0x50 [ 833.309248] x64_sys_call+0x18c5/0x18d0 [ 833.309284] do_syscall_64+0xbf/0x360 [ 833.309307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.309328] RIP: 0033:0x7f5141970b19 [ 833.309345] Code: Unable to access opcode bytes at 0x7f5141970aef. [ 833.309355] RSP: 002b:00007ffef88118b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 833.309376] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f5141970b19 [ 833.309390] RDX: 00007f514192372b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 833.309404] RBP: 0000000000000000 R08: 0000001b2d121fe0 R09: 0000000000000000 [ 833.309417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 833.309429] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef88119a0 [ 833.309458] [ 833.309465] kmemleak: Object (percpu) 0x607f1a63e890 (size 8): [ 833.309478] kmemleak: comm "syz-executor.3", pid 9108, jiffies 4295500182 [ 833.309491] kmemleak: min_count = 1 [ 833.309498] kmemleak: count = 0 [ 833.309505] kmemleak: flags = 0x21 [ 833.309512] kmemleak: checksum = 0 [ 833.309519] kmemleak: backtrace: [ 833.309525] pcpu_alloc_noprof+0x87a/0x1170 [ 833.309554] percpu_ref_init+0x37/0x400 [ 833.309574] io_uring_setup+0x44c/0x2000 [ 833.309596] __x64_sys_io_uring_setup+0xc8/0x170 [ 833.309617] do_syscall_64+0xbf/0x360 [ 833.309635] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:48 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:48 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:48 executing program 3: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, 0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r0, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:48 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:58 executing program 3: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, 0x0, 0x0) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x0, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:58 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, 0x0, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:58 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r0, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 0: io_uring_setup(0x1d74, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:58 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r0, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:58 executing program 7: syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x5752, &(0x7f00000002c0), &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) [ 843.507837] kmemleak: Found object by alias at 0x607f1a63e26c [ 843.507863] CPU: 0 UID: 0 PID: 9160 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 843.507887] Tainted: [W]=WARN [ 843.507892] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 843.507901] Call Trace: [ 843.507906] [ 843.507912] dump_stack_lvl+0xca/0x120 [ 843.507944] __lookup_object+0x94/0xb0 [ 843.507966] delete_object_full+0x27/0x70 [ 843.507988] free_percpu+0x30/0x1160 [ 843.508009] ? arch_uprobe_clear_state+0x16/0x140 [ 843.508036] futex_hash_free+0x38/0xc0 [ 843.508054] mmput+0x2d3/0x390 [ 843.508079] do_exit+0x79d/0x2970 [ 843.508102] ? __pfx_do_exit+0x10/0x10 [ 843.508121] ? find_held_lock+0x2b/0x80 [ 843.508144] ? get_signal+0x835/0x2340 [ 843.508170] do_group_exit+0xd3/0x2a0 [ 843.508190] get_signal+0x2315/0x2340 [ 843.508213] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 843.508240] ? __pfx_get_signal+0x10/0x10 [ 843.508261] ? do_futex+0x135/0x370 [ 843.508279] ? __pfx_do_futex+0x10/0x10 [ 843.508299] arch_do_signal_or_restart+0x80/0x790 [ 843.508322] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 843.508344] ? __x64_sys_futex+0x1c9/0x4d0 [ 843.508360] ? __x64_sys_futex+0x1d2/0x4d0 [ 843.508380] ? __pfx___x64_sys_futex+0x10/0x10 [ 843.508398] ? xfd_validate_state+0x55/0x180 [ 843.508425] exit_to_user_mode_loop+0x8b/0x110 [ 843.508453] do_syscall_64+0x2f7/0x360 [ 843.508469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.508485] RIP: 0033:0x7fcf751aeb19 [ 843.508497] Code: Unable to access opcode bytes at 0x7fcf751aeaef. [ 843.508504] RSP: 002b:00007fcf72724218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 843.508519] RAX: fffffffffffffe00 RBX: 00007fcf752c1f68 RCX: 00007fcf751aeb19 [ 843.508529] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fcf752c1f68 [ 843.508538] RBP: 00007fcf752c1f60 R08: 0000000000000000 R09: 0000000000000000 [ 843.508547] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf752c1f6c [ 843.508556] R13: 00007fff13acd96f R14: 00007fcf72724300 R15: 0000000000022000 [ 843.508576] [ 843.508581] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 843.508590] kmemleak: comm "syz-executor.1", pid 9167, jiffies 4295510420 [ 843.508599] kmemleak: min_count = 1 [ 843.508604] kmemleak: count = 0 [ 843.508609] kmemleak: flags = 0x21 [ 843.508614] kmemleak: checksum = 0 [ 843.508619] kmemleak: backtrace: [ 843.508623] pcpu_alloc_noprof+0x87a/0x1170 [ 843.508644] percpu_ref_init+0x37/0x400 [ 843.508657] io_uring_setup+0x44c/0x2000 [ 843.508672] __x64_sys_io_uring_setup+0xc8/0x170 [ 843.508687] do_syscall_64+0xbf/0x360 [ 843.508699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.536243] kmemleak: Cannot insert 0x607f1a63e26c into the object search tree (overlaps existing) [ 843.536263] CPU: 0 UID: 0 PID: 9167 Comm: syz-executor.1 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 843.536286] Tainted: [W]=WARN [ 843.536291] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 843.536300] Call Trace: [ 843.536305] [ 843.536311] dump_stack_lvl+0xca/0x120 [ 843.536340] __link_object+0x190/0x210 [ 843.536363] __create_object+0x48/0x80 [ 843.536385] pcpu_alloc_noprof+0x87a/0x1170 [ 843.536415] __percpu_counter_init_many+0x44/0x360 [ 843.536435] ? kasan_save_track+0x14/0x30 [ 843.536520] io_uring_alloc_task_context+0xce/0x650 [ 843.536546] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 843.536576] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 843.536600] io_sq_offload_create+0xbc6/0x11a0 [ 843.536624] ? __pfx_io_sq_offload_create+0x10/0x10 [ 843.536647] ? security_capable+0x2f/0x90 [ 843.536669] io_uring_setup+0x143e/0x2000 [ 843.536687] ? __pfx_io_uring_setup+0x10/0x10 [ 843.536718] ? __pfx___x64_sys_futex+0x10/0x10 [ 843.536736] ? xfd_validate_state+0x55/0x180 [ 843.536762] __x64_sys_io_uring_setup+0xc8/0x170 [ 843.536781] do_syscall_64+0xbf/0x360 [ 843.536796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.536811] RIP: 0033:0x7fbea1b10b19 [ 843.536823] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 843.536837] RSP: 002b:00007fbe9f086108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 843.536852] RAX: ffffffffffffffda RBX: 00007fbea1c23f60 RCX: 00007fbea1b10b19 [ 843.536861] RDX: 0000000020ff2000 RSI: 0000000020000640 RDI: 00000000000028c1 [ 843.536870] RBP: 0000000020000640 R08: 0000000020000700 R09: 0000000020000700 [ 843.536879] R10: 00000000200006c0 R11: 0000000000000202 R12: 0000000020000700 [ 843.536888] R13: 0000000020ff2000 R14: 00000000200006c0 R15: 0000000020ffc000 [ 843.536908] [ 843.537568] kmemleak: Kernel memory leak detector disabled [ 843.537573] kmemleak: Object (percpu) 0x607f1a63e268 (size 8): [ 843.537582] kmemleak: comm "syz-executor.1", pid 9167, jiffies 4295510420 [ 843.537591] kmemleak: min_count = 1 [ 843.537595] kmemleak: count = 0 [ 843.537600] kmemleak: flags = 0x21 [ 843.537605] kmemleak: checksum = 0 [ 843.537611] kmemleak: backtrace: [ 843.537615] pcpu_alloc_noprof+0x87a/0x1170 [ 843.537636] percpu_ref_init+0x37/0x400 [ 843.537649] io_uring_setup+0x44c/0x2000 [ 843.537662] __x64_sys_io_uring_setup+0xc8/0x170 [ 843.537677] do_syscall_64+0xbf/0x360 [ 843.537689] entry_SYSCALL_64_after_hwframe+0x77/0x7f 23:31:58 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:59 executing program 3: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) 23:31:59 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:59 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) [ 843.625716] kmemleak: Automatic memory scanning thread ended 23:31:59 executing program 2: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) 23:31:59 executing program 6: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x10, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r2, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200400, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') r4 = io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281, 0x0, r4}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:59 executing program 1: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) socket$packet(0x11, 0x2, 0x300) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:59 executing program 5: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc6"}}}}}}, 0x28) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_io_uring_setup(0x28c1, &(0x7f0000000640)={0x0, 0x37d2, 0x2, 0x2, 0x281}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xc000)=nil, &(0x7f00000006c0), &(0x7f0000000700)) 23:31:59 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') syz_io_uring_setup(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0x0, 0x0) 23:31:59 executing program 4: io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, &(0x7f0000000000), 0x1) r0 = io_uring_setup(0x1d74, &(0x7f0000000040)={0x0, 0x21aa, 0x0, 0x3, 0x18c}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10400, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @broadcast, @void, {@llc_tr={0x11, {@llc={0xf0, 0x0, "bd56", "147389053bec010a1b5601cd13809d09898a58d24fc60f82b2cc5506b3"}}}}}}, 0x2f) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000001c0)={0x0, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @dev, @loopback}, &(0x7f0000000240)=0xc) bind$packet(r1, &(0x7f0000000280)={0x11, 0x3, 0x0, 0x1, 0x9, 0x6, @remote}, 0x14) syz_io_uring_setup(0x5752, &(0x7f00000002c0)={0x0, 0x18d9, 0x0, 0x3, 0x373, 0x0, r1}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000000340), &(0x7f0000000380)) eventfd2(0x0, 0x800) syz_io_uring_setup(0x4bfb, &(0x7f0000000440)={0x0, 0xca1d, 0x20, 0x3, 0x24f}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f00000004c0), &(0x7f0000000500)) syz_open_procfs(0x0, &(0x7f0000000540)='net/ip_vs_stats_percpu\x00') io_uring_setup(0x436f, &(0x7f00000005c0)={0x0, 0x4cff, 0x8, 0x1, 0x3ad, 0x0, r0}) SYZFAIL: failed to write(kmemleak, "scan") (errno 1: Operation not permitted) BUG: leak checking failed VM DIAGNOSIS: 23:31:59 Registers: info registers vcpu 0 RAX=0000000000000001 RBX=ffff88800ab4f3f8 RCX=ffffffff815c4d1d RDX=fffffbfff0c8768b RSI=0000000000000008 RDI=ffffffff8643b450 RBP=ffff88806ce37d00 RSP=ffff88803d467c18 R8 =0000000000000000 R9 =fffffbfff0c8768a R10=ffffffff8643b457 R11=0000000000000000 R12=0000000000000200 R13=0000000000000000 R14=ffff88806ce37df0 R15=ffff88806ce37da8 RIP=ffffffff815c4f95 RFL=00000047 [---Z-PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e55d8000 00000000 00000000 LDT=0000 fffffe4300000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f181ce3e3b8 CR3=000000001eb66000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=f4857593dcc28e70a4b750470ebf31b1 XMM02=ef8184c7b86fabf574c84ce0a4c2f066 XMM03=a19468f1558da24d52033f9f0cb9b8b6 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=0d0c0f0e09080b0a0504070601000302 XMM07=0e0d0c0f0a09080b0605040702010003 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=ffffffff8183546f RBX=dffffc0000000000 RCX=ffffffff81836b56 RDX=0000000000000000 RSI=ffffffff81831c04 RDI=ffffffff85843748 RBP=ffff88801820fd18 RSP=ffff88801820fc50 R8 =0000000000000000 R9 =ffffed1002ffef86 R10=00000000c000003e R11=0000000000000000 R12=00000000000000a5 R13=ffff88801820fd50 R14=ffffc900006c1080 R15=00000000000000a5 RIP=ffffffff81835473 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f1fa5d8e8c0 00000000 00000000 GS =0000 ffff8880e56d8000 00000000 00000000 LDT=0000 fffffe5300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055c26c0e8000 CR3=000000000c1ef000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=000000000000002f002f2e2e2f002e2e XMM01=0000000000000000696c61766e49002f XMM02=ffffffffffffff0f0e0d0c0b0a090807 XMM03=0000000000000000000030706f6f6c2f XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=000055c26c0b7f60000055c26c0cbdf0 XMM06=000055c26c0b9ce00000000000000000 XMM07=00000000000000000000000000000000 XMM08=2f63697361622f6372732f2e2e000d0a XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000