Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:3005' (ECDSA) to the list of known hosts. 2026/01/13 14:11:37 fuzzer started 2026/01/13 14:11:37 dialing manager at localhost:38155 syzkaller login: [ 44.879765] cgroup: Unknown subsys name 'net' [ 44.955907] cgroup: Unknown subsys name 'cpuset' [ 44.971037] cgroup: Unknown subsys name 'rlimit' 2026/01/13 14:11:48 syscalls: 207 2026/01/13 14:11:48 code coverage: enabled 2026/01/13 14:11:48 comparison tracing: enabled 2026/01/13 14:11:48 extra coverage: enabled 2026/01/13 14:11:48 setuid sandbox: enabled 2026/01/13 14:11:48 namespace sandbox: enabled 2026/01/13 14:11:48 Android sandbox: enabled 2026/01/13 14:11:48 fault injection: enabled 2026/01/13 14:11:48 leak checking: enabled 2026/01/13 14:11:48 net packet injection: enabled 2026/01/13 14:11:48 net device setup: enabled 2026/01/13 14:11:48 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2026/01/13 14:11:48 devlink PCI setup: PCI device 0000:00:10.0 is not available 2026/01/13 14:11:48 USB emulation: enabled 2026/01/13 14:11:48 hci packet injection: enabled 2026/01/13 14:11:48 wifi device emulation: enabled 2026/01/13 14:11:48 802.15.4 emulation: enabled 2026/01/13 14:11:48 fetching corpus: 0, signal 0/0 (executing program) 2026/01/13 14:11:49 starting 8 fuzzer processes 14:11:49 executing program 1: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)="58f3eb2e4a66062ea8762f12a40d6289acefe5be2522e4725347eda6247b3fc8172fa9484bc97effe1ee64ed", 0x2c) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x80) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x6, 0x2, 0x7}, 0x6, 0x1}) write$cgroup_devices(r0, &(0x7f0000000240)={'b', ' *:* ', 'm\x00'}, 0x8) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000280)=@gcm_128={{0x303}, "0f936e770c6b114e", "1a336e126c052a98bae63b0958499a83", "a3fd997a", "1f26b9ba24ce147f"}, 0x28) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x4401, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000300)) r3 = accept4$inet(r0, &(0x7f0000000340)={0x2, 0x0, @multicast1}, &(0x7f0000000380)=0x10, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f00000004c0)={'broute\x00', 0x0, 0x3, 0x52, [0x4, 0x4, 0x7, 0x7f, 0x7, 0x37], 0x5, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], &(0x7f0000000440)=""/82}, &(0x7f0000000540)=0x78) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ipvlan0\x00', @link_local}) pipe2(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000600)={0xffffffffffffffff, 0x3, 0x3}) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000640)="8e7f6f1b34c037e8bbf891d5894742812de562c7d0ebd371fe68bd1724c31805c53141956ffbb286b930e48488ea472ebddaafbff2e26ee68e797159a05fba3ff5989f235a9b8fa271b1d717fbacc73e7bcf151bdfabbeb79c341a7fd7c64d4477ab2836736e9ac759a53a0d75b45473395911dddcf2ecedbe9a4e039c1bdf2add3b271d79229e483cea69056d0a9b2e251f3a6afe45ed15aa1d49f61aa2bebafdff306a607e58d91a33207913e1e99ed959679300a95a030de2", 0xba) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f0000000700)=0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000780)={'veth0_to_batadv\x00', @remote}) 14:11:49 executing program 0: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x4e}]}, 0x44}, 0x1, 0x0, 0x0, 0xc840}, 0x800) socketpair(0x1d, 0x80001, 0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffff9}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x20000000) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280), 0x40083, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r2, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c004}, 0x2044890) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x401}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), r0) sendmsg$WG_CMD_GET_DEVICE(r3, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x7c, r4, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x100}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e23}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4c841}, 0x20008041) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24}]}, 0x50}}, 0x58000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r5, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x50, r2, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8050) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000900)={{0x1, 0x2, 0x3, 0x2, 0x4}, 0x5, 0x914e, 'id1\x00', 'timer1\x00', 0x0, 0x200, 0x31fd, 0x7, 0x3}) r6 = socket(0x1, 0x8000a, 0x3f) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a00), r6) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x3c, r2, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x53}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4004040) r7 = inotify_init1(0x80000) r8 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x800) inotify_rm_watch(r7, r8) 14:11:49 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000bc0)={'broute\x00', 0x0, 0x4, 0xbc, [0x0, 0xce7, 0xffffffffffffff69, 0x7, 0x0, 0x1], 0x3, &(0x7f0000000ac0)=[{}, {}, {}], &(0x7f0000000b00)=""/188}, &(0x7f0000000c40)=0x78) 14:11:49 executing program 7: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'netpci0\x00'}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x400080, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x404840, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0xf) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x3, 0x2, 0x80, 0x2, 0xffff}, 0x3, 0x8, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)={'vxcan1\x00'}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r4 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0xc) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f00000004c0)=0x1) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x100) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{0x0, 0x7, 0x2, 0x81}, {0x7f, 0x0, 0xff, 0xae0}, {0x100, 0x3, 0x7, 0x4}, {0xe45, 0x2, 0x9, 0xff}, {0x329e, 0x20, 0x7, 0x896}, {0x6, 0x81, 0xff, 0x4}]}) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, &(0x7f00000005c0)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r4) 14:11:49 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000007c0)={0x2, 'nr0\x00', 0x4}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000800)) [ 56.038608] audit: type=1400 audit(1768313509.913:7): avc: denied { execmem } for pid=273 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 14:11:49 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x1c}}, 0x20000080) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x5c, r1, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x30004010}, 0xc054) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x6, 0x6200) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, 0xffffffffffffffff) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x80a00) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000380)={0xffffffffffffffff, 0x1, 0x7, 0x0, 0xbf2}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x80000001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000580)={&(0x7f00000004c0), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r1, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008084}, 0x20000000) socket$inet_icmp(0x2, 0x2, 0x1) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48844}, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f00000006c0)={0x0, {}, 0x0, {}, 0x8, 0x1, 0x14, 0x0, "c5c6bfafb99aed3ec5bbb3fa02a29b4175a7321abd49e8a8a9c93c8bf844da6a4cbfb13372f46f06fbea653b858d18140c9e1d8e130e12c9ca0a4b7aaae01c3c", "58fb052d054728b185bf1d1dd8fffcaa35db09225a6d1f651783a3fd916eebb3", [0x6, 0x3]}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x14, r0, 0x10, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x10000}, 0x800) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$inet(r4, &(0x7f0000000880)={0x2, 0x0, @local}, &(0x7f00000008c0)=0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000900), 0xffffffffffffffff) getpeername$inet(0xffffffffffffffff, &(0x7f0000000940)={0x2, 0x0, @initdev}, &(0x7f0000000980)=0x10) 14:11:49 executing program 5: setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000), 0x4) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7f, 0x9, 0x0, 0x6, 0x9, 0x4, "01e2cb1d614af59fdb78b92feccab9eafe47ad00741aee5f90f4a04d5c3e71a70e49a85db1cdcfa53dde76ebaba247fedbc6b56df23a6b34b2e4527f1121365b", "d799ce08e38dd66548a799e6f72ee22348cf2cb435a0f60f0548cd2a254126df525542757f9719344eb2e17445d8be625963ce6fbb222248aef8bdef728cb7ce", "2ccda8522685eac48fb6b78433386623bfb51ec9910cd6615a0c703f7dac8685", [0x1812, 0x3]}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x420001, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000180)={0x0, {{0x2, 0x4e20, @rand_addr=0x64010100}}, {{0x2, 0x4e24, @remote}}}, 0x108) r1 = getuid() setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@rand_addr=0x64010102, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x8, 0x4e22, 0x1, 0xa, 0xa0, 0x0, 0x2f, 0x0, r1}, {0x10000, 0x3e0000000, 0xfffffffffffffe00, 0x7, 0x10001, 0xfff}, {0x0, 0x6d907cdc, 0x30f, 0x10001}, 0xffffffff, 0x6e6bb0, 0x0, 0x0, 0x3, 0x1}, {{@in6=@private0, 0x4d5, 0x2b}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x3503, 0x0, 0x2, 0x0, 0xffffb1f3, 0x800, 0x9}}, 0xe8) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffff000}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r4, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xbec}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000640), 0x4) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "38afac8cbc47e00b", "7674cda1da71358e2fccea22ac864c44", "4946ab32", "71ab904e1f783560"}, 0x28) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f00000006c0)) pipe2(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r7, 0x54a2) getsockopt$inet_tcp_int(r6, 0x6, 0x7, &(0x7f0000000740), &(0x7f0000000780)=0x4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000007c0), 0x4) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000800)) prctl$PR_SET_FP_MODE(0x2d, 0x3) 14:11:50 executing program 6: r0 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0xffff}, 0x4) r1 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @broadcast}, &(0x7f00000000c0)=0xc) accept$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) geteuid() ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000180)={0x0, 0x9, 0x6, 0x0, 0xd}) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000200)={{0x2, 0x4e23, @remote}, {0x1}, 0x10, {0x2, 0x4e24, @empty}, 'veth0_to_team\x00'}) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000280)=0x1) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r3, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7b2c}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xff9}, @BATADV_ATTR_VLANID={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008010}, 0x40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x24, r5, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20b}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xc001}, 0xc010) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30a) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000000) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0xde, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7fffffff}]}, 0x40}, 0x1, 0x0, 0x0, 0x48081}, 0x4000) [ 57.165268] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 57.168323] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 57.170966] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 57.175964] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 57.180218] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 57.356691] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 57.358545] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 57.362981] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 57.366737] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 57.369727] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 57.556935] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 57.558979] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 57.566923] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 57.573694] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 57.575199] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 57.578702] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 57.581342] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 57.584164] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 57.586595] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 57.588596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 57.589181] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 57.595916] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 57.596988] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 57.599594] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.603572] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 57.604599] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 57.647978] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 57.648931] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 57.649725] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 57.651238] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 57.653755] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 57.655083] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.656149] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 57.656989] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 57.659837] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 57.666755] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 57.682681] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 57.689717] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 57.731819] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 57.743781] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 59.263542] Bluetooth: hci0: command tx timeout [ 59.390709] Bluetooth: hci1: command tx timeout [ 59.646817] Bluetooth: hci2: command tx timeout [ 59.647320] Bluetooth: hci3: command tx timeout [ 59.710511] Bluetooth: hci6: command tx timeout [ 59.710552] Bluetooth: hci4: command tx timeout [ 59.776495] Bluetooth: hci5: command tx timeout [ 59.840104] Bluetooth: hci7: command tx timeout [ 61.311467] Bluetooth: hci0: command tx timeout [ 61.439638] Bluetooth: hci1: command tx timeout [ 61.695463] Bluetooth: hci3: command tx timeout [ 61.695899] Bluetooth: hci2: command tx timeout [ 61.759326] Bluetooth: hci6: command tx timeout [ 61.759495] Bluetooth: hci4: command tx timeout [ 61.824640] Bluetooth: hci5: command tx timeout [ 61.889446] Bluetooth: hci7: command tx timeout [ 63.359534] Bluetooth: hci0: command tx timeout [ 63.488447] Bluetooth: hci1: command tx timeout [ 63.744456] Bluetooth: hci2: command tx timeout [ 63.744694] Bluetooth: hci3: command tx timeout [ 63.806510] Bluetooth: hci6: command tx timeout [ 63.808463] Bluetooth: hci4: command tx timeout [ 63.871521] Bluetooth: hci5: command tx timeout [ 63.936034] Bluetooth: hci7: command tx timeout [ 65.407534] Bluetooth: hci0: command tx timeout [ 65.536408] Bluetooth: hci1: command tx timeout [ 65.790519] Bluetooth: hci3: command tx timeout [ 65.791606] Bluetooth: hci2: command tx timeout [ 65.855624] Bluetooth: hci4: command tx timeout [ 65.856065] Bluetooth: hci6: command tx timeout [ 65.918482] Bluetooth: hci5: command tx timeout [ 65.983459] Bluetooth: hci7: command tx timeout [ 92.157137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.174299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.931462] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.932066] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.009629] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.010240] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.077827] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.078459] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.342668] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.343305] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.367819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.368543] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.551779] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.552459] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.641010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.641679] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:28 executing program 7: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'netpci0\x00'}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x400080, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x404840, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0xf) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x3, 0x2, 0x80, 0x2, 0xffff}, 0x3, 0x8, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)={'vxcan1\x00'}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r4 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0xc) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f00000004c0)=0x1) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x100) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{0x0, 0x7, 0x2, 0x81}, {0x7f, 0x0, 0xff, 0xae0}, {0x100, 0x3, 0x7, 0x4}, {0xe45, 0x2, 0x9, 0xff}, {0x329e, 0x20, 0x7, 0x896}, {0x6, 0x81, 0xff, 0x4}]}) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, &(0x7f00000005c0)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r4) [ 94.738945] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.739572] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.762748] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.763335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:28 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000007c0)={0x2, 'nr0\x00', 0x4}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000800)) 14:12:28 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000007c0)={0x2, 'nr0\x00', 0x4}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000800)) [ 94.875743] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.876375] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:28 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000007c0)={0x2, 'nr0\x00', 0x4}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000800)) [ 94.974535] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.975719] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:28 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000bc0)={'broute\x00', 0x0, 0x4, 0xbc, [0x0, 0xce7, 0xffffffffffffff69, 0x7, 0x0, 0x1], 0x3, &(0x7f0000000ac0)=[{}, {}, {}], &(0x7f0000000b00)=""/188}, &(0x7f0000000c40)=0x78) [ 95.073584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.074395] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:28 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000007c0)={0x2, 'nr0\x00', 0x4}, 0x18) 14:12:29 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000bc0)={'broute\x00', 0x0, 0x4, 0xbc, [0x0, 0xce7, 0xffffffffffffff69, 0x7, 0x0, 0x1], 0x3, &(0x7f0000000ac0)=[{}, {}, {}], &(0x7f0000000b00)=""/188}, &(0x7f0000000c40)=0x78) 14:12:29 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000740)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000780)={'bond_slave_0\x00'}) [ 95.202670] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.203323] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.109488] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.110086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.168370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.169039] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 14:12:40 executing program 5: setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000), 0x4) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7f, 0x9, 0x0, 0x6, 0x9, 0x4, "01e2cb1d614af59fdb78b92feccab9eafe47ad00741aee5f90f4a04d5c3e71a70e49a85db1cdcfa53dde76ebaba247fedbc6b56df23a6b34b2e4527f1121365b", "d799ce08e38dd66548a799e6f72ee22348cf2cb435a0f60f0548cd2a254126df525542757f9719344eb2e17445d8be625963ce6fbb222248aef8bdef728cb7ce", "2ccda8522685eac48fb6b78433386623bfb51ec9910cd6615a0c703f7dac8685", [0x1812, 0x3]}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x420001, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000180)={0x0, {{0x2, 0x4e20, @rand_addr=0x64010100}}, {{0x2, 0x4e24, @remote}}}, 0x108) r1 = getuid() setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@rand_addr=0x64010102, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x8, 0x4e22, 0x1, 0xa, 0xa0, 0x0, 0x2f, 0x0, r1}, {0x10000, 0x3e0000000, 0xfffffffffffffe00, 0x7, 0x10001, 0xfff}, {0x0, 0x6d907cdc, 0x30f, 0x10001}, 0xffffffff, 0x6e6bb0, 0x0, 0x0, 0x3, 0x1}, {{@in6=@private0, 0x4d5, 0x2b}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x3503, 0x0, 0x2, 0x0, 0xffffb1f3, 0x800, 0x9}}, 0xe8) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffff000}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r4, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xbec}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000640), 0x4) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "38afac8cbc47e00b", "7674cda1da71358e2fccea22ac864c44", "4946ab32", "71ab904e1f783560"}, 0x28) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f00000006c0)) pipe2(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r7, 0x54a2) getsockopt$inet_tcp_int(r6, 0x6, 0x7, &(0x7f0000000740), &(0x7f0000000780)=0x4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000007c0), 0x4) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000800)) prctl$PR_SET_FP_MODE(0x2d, 0x3) 14:12:40 executing program 0: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x4e}]}, 0x44}, 0x1, 0x0, 0x0, 0xc840}, 0x800) socketpair(0x1d, 0x80001, 0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffff9}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x20000000) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280), 0x40083, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r2, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c004}, 0x2044890) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x401}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), r0) sendmsg$WG_CMD_GET_DEVICE(r3, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x7c, r4, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x100}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e23}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4c841}, 0x20008041) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24}]}, 0x50}}, 0x58000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r5, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x50, r2, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8050) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000900)={{0x1, 0x2, 0x3, 0x2, 0x4}, 0x5, 0x914e, 'id1\x00', 'timer1\x00', 0x0, 0x200, 0x31fd, 0x7, 0x3}) r6 = socket(0x1, 0x8000a, 0x3f) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a00), r6) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x3c, r2, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x53}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4004040) r7 = inotify_init1(0x80000) r8 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x800) inotify_rm_watch(r7, r8) 14:12:40 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x1c}}, 0x20000080) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x5c, r1, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x30004010}, 0xc054) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x6, 0x6200) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, 0xffffffffffffffff) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x80a00) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000380)={0xffffffffffffffff, 0x1, 0x7, 0x0, 0xbf2}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x80000001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000580)={&(0x7f00000004c0), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r1, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008084}, 0x20000000) socket$inet_icmp(0x2, 0x2, 0x1) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48844}, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f00000006c0)={0x0, {}, 0x0, {}, 0x8, 0x1, 0x14, 0x0, "c5c6bfafb99aed3ec5bbb3fa02a29b4175a7321abd49e8a8a9c93c8bf844da6a4cbfb13372f46f06fbea653b858d18140c9e1d8e130e12c9ca0a4b7aaae01c3c", "58fb052d054728b185bf1d1dd8fffcaa35db09225a6d1f651783a3fd916eebb3", [0x6, 0x3]}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x14, r0, 0x10, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x10000}, 0x800) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$inet(r4, &(0x7f0000000880)={0x2, 0x0, @local}, &(0x7f00000008c0)=0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000900), 0xffffffffffffffff) getpeername$inet(0xffffffffffffffff, &(0x7f0000000940)={0x2, 0x0, @initdev}, &(0x7f0000000980)=0x10) 14:12:40 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r1, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000740)) 14:12:40 executing program 1: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)="58f3eb2e4a66062ea8762f12a40d6289acefe5be2522e4725347eda6247b3fc8172fa9484bc97effe1ee64ed", 0x2c) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x80) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x6, 0x2, 0x7}, 0x6, 0x1}) write$cgroup_devices(r0, &(0x7f0000000240)={'b', ' *:* ', 'm\x00'}, 0x8) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000280)=@gcm_128={{0x303}, "0f936e770c6b114e", "1a336e126c052a98bae63b0958499a83", "a3fd997a", "1f26b9ba24ce147f"}, 0x28) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x4401, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000300)) r3 = accept4$inet(r0, &(0x7f0000000340)={0x2, 0x0, @multicast1}, &(0x7f0000000380)=0x10, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f00000004c0)={'broute\x00', 0x0, 0x3, 0x52, [0x4, 0x4, 0x7, 0x7f, 0x7, 0x37], 0x5, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], &(0x7f0000000440)=""/82}, &(0x7f0000000540)=0x78) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ipvlan0\x00', @link_local}) pipe2(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000600)={0xffffffffffffffff, 0x3, 0x3}) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000640)="8e7f6f1b34c037e8bbf891d5894742812de562c7d0ebd371fe68bd1724c31805c53141956ffbb286b930e48488ea472ebddaafbff2e26ee68e797159a05fba3ff5989f235a9b8fa271b1d717fbacc73e7bcf151bdfabbeb79c341a7fd7c64d4477ab2836736e9ac759a53a0d75b45473395911dddcf2ecedbe9a4e039c1bdf2add3b271d79229e483cea69056d0a9b2e251f3a6afe45ed15aa1d49f61aa2bebafdff306a607e58d91a33207913e1e99ed959679300a95a030de2", 0xba) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f0000000700)=0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000780)={'veth0_to_batadv\x00', @remote}) 14:12:40 executing program 6: r0 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0xffff}, 0x4) r1 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @broadcast}, &(0x7f00000000c0)=0xc) accept$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) geteuid() ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000180)={0x0, 0x9, 0x6, 0x0, 0xd}) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000200)={{0x2, 0x4e23, @remote}, {0x1}, 0x10, {0x2, 0x4e24, @empty}, 'veth0_to_team\x00'}) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000280)=0x1) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r3, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7b2c}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xff9}, @BATADV_ATTR_VLANID={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008010}, 0x40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x24, r5, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20b}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xc001}, 0xc010) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30a) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000000) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0xde, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7fffffff}]}, 0x40}, 0x1, 0x0, 0x0, 0x48081}, 0x4000) 14:12:40 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000bc0)={'broute\x00', 0x0, 0x4, 0xbc, [0x0, 0xce7, 0xffffffffffffff69, 0x7, 0x0, 0x1], 0x3, &(0x7f0000000ac0)=[{}, {}, {}], &(0x7f0000000b00)=""/188}, &(0x7f0000000c40)=0x78) 14:12:40 executing program 7: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'netpci0\x00'}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x400080, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x404840, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0xf) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x3, 0x2, 0x80, 0x2, 0xffff}, 0x3, 0x8, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)={'vxcan1\x00'}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r4 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0xc) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f00000004c0)=0x1) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x100) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{0x0, 0x7, 0x2, 0x81}, {0x7f, 0x0, 0xff, 0xae0}, {0x100, 0x3, 0x7, 0x4}, {0xe45, 0x2, 0x9, 0xff}, {0x329e, 0x20, 0x7, 0x896}, {0x6, 0x81, 0xff, 0x4}]}) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, &(0x7f00000005c0)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r4) 14:12:40 executing program 7: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'netpci0\x00'}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x400080, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x404840, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0xf) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x3, 0x2, 0x80, 0x2, 0xffff}, 0x3, 0x8, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)={'vxcan1\x00'}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r4 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0xc) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f00000004c0)=0x1) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x100) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{0x0, 0x7, 0x2, 0x81}, {0x7f, 0x0, 0xff, 0xae0}, {0x100, 0x3, 0x7, 0x4}, {0xe45, 0x2, 0x9, 0xff}, {0x329e, 0x20, 0x7, 0x896}, {0x6, 0x81, 0xff, 0x4}]}) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, &(0x7f00000005c0)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r4) 14:12:40 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) [ 107.150351] [ 107.150575] ===================================== [ 107.150959] WARNING: bad unlock balance detected! [ 107.151342] 6.19.0-rc5-next-20260113 #1 Not tainted [ 107.151730] ------------------------------------- [ 107.152100] syz-executor.2/3986 is trying to release lock (rcu_read_lock) at: [ 107.152658] [] __wait_on_freeing_inode+0x105/0x350 [ 107.154109] but there are no more locks to release! [ 107.155369] [ 107.155369] other info that might help us debug this: [ 107.156927] 4 locks held by syz-executor.2/3986: [ 107.158084] #0: ffff88800fb283f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400 [ 107.160355] #1: ffff88803c05aa00 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400 [ 107.162649] #2: ffff88800fb2c950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 [ 107.163364] #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 [ 107.164106] [ 107.164106] stack backtrace: [ 107.164468] CPU: 1 UID: 0 PID: 3986 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260113 #1 PREEMPT(lazy) [ 107.164482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 107.164489] Call Trace: [ 107.164495] [ 107.164499] dump_stack_lvl+0xca/0x120 [ 107.164531] ? __wait_on_freeing_inode+0x105/0x350 [ 107.164546] print_unlock_imbalance_bug+0x118/0x130 [ 107.164561] ? __wait_on_freeing_inode+0x105/0x350 [ 107.164576] lock_release+0x1ee/0x270 [ 107.164591] __wait_on_freeing_inode+0x10a/0x350 [ 107.164606] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 107.164622] ? __pfx_var_wake_function+0x10/0x10 [ 107.164640] ? lock_is_held_type+0x9e/0x120 [ 107.164652] insert_inode_locked+0x25f/0x890 [ 107.164669] __ext4_new_inode+0x223d/0x4cd0 [ 107.164696] ? __pfx___ext4_new_inode+0x10/0x10 [ 107.164711] ? __pfx___dquot_initialize+0x10/0x10 [ 107.164730] ? __pfx_avc_has_perm+0x10/0x10 [ 107.164747] ext4_symlink+0x406/0xb40 [ 107.164766] ? __pfx_ext4_symlink+0x10/0x10 [ 107.164781] ? security_inode_permission+0x72/0xe0 [ 107.164795] vfs_symlink+0x44b/0x840 [ 107.164812] do_symlinkat+0x153/0x440 [ 107.164826] ? __pfx_do_symlinkat+0x10/0x10 [ 107.164839] ? strncpy_from_user+0x21b/0x2f0 [ 107.164857] __x64_sys_symlink+0x79/0xa0 [ 107.164870] do_syscall_64+0xbf/0x420 [ 107.164884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.164896] RIP: 0033:0x7f6b93245427 [ 107.164906] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 107.164917] RSP: 002b:00007ffe264f0528 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 [ 107.164928] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6b93245427 [ 107.164935] RDX: 00007ffe264f0607 RSI: 00007f6b932a0019 RDI: 00007ffe264f05f0 [ 107.164942] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffe264f03c0 [ 107.164949] R10: 00007ffe264f0277 R11: 0000000000000206 R12: 0000000000000001 [ 107.164956] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe264f05f0 [ 107.164966] [ 107.180711] ------------[ cut here ]------------ [ 107.181096] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.2/3986 [ 107.208512] Modules linked in: [ 107.208823] CPU: 1 UID: 0 PID: 3986 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260113 #1 PREEMPT(lazy) [ 107.237661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 107.238312] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 [ 107.268206] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 a6 bb de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 89 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 61 f9 73 03 e8 0c 88 56 00 e9 [ 107.299801] RSP: 0018:ffff88804158f9a0 EFLAGS: 00010286 [ 107.300238] RAX: 00000000ffffffff RBX: ffff888013fc9b80 RCX: ffffffff815664c7 [ 107.328851] RDX: 0000000000000000 RSI: ffffffff815664d0 RDI: ffff888013fc9f7c [ 107.344386] RBP: ffff888013fc9b80 R08: 0000000000000000 R09: fffffbfff0ba6ff4 [ 107.453312] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888013fc9b80 [ 107.501742] R13: 0000000000000001 R14: ffffffff85c0eb40 R15: ffff88803c0745d0 [ 107.502309] FS: 00005555929bc400(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000 [ 107.520775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.521236] CR2: 00007f6b932a0019 CR3: 0000000048055000 CR4: 0000000000350ef0 [ 107.522610] Call Trace: [ 107.522851] [ 107.524024] __wait_on_freeing_inode+0x10f/0x350 [ 107.524724] ? __pfx___wait_on_freeing_inode+0x10/0x10 [ 107.525756] ? __pfx_var_wake_function+0x10/0x10 [ 107.526928] ? lock_is_held_type+0x9e/0x120 [ 107.527971] insert_inode_locked+0x25f/0x890 [ 107.529527] __ext4_new_inode+0x223d/0x4cd0 [ 107.531832] ? __pfx___ext4_new_inode+0x10/0x10 [ 107.533002] ? __pfx___dquot_initialize+0x10/0x10 [ 107.533756] ? __pfx_avc_has_perm+0x10/0x10 [ 107.535400] ext4_symlink+0x406/0xb40 [ 107.537560] ? __pfx_ext4_symlink+0x10/0x10 [ 107.538519] ? security_inode_permission+0x72/0xe0 [ 107.540030] vfs_symlink+0x44b/0x840 [ 107.541233] do_symlinkat+0x153/0x440 [ 107.542276] ? __pfx_do_symlinkat+0x10/0x10 [ 107.542979] ? strncpy_from_user+0x21b/0x2f0 [ 107.544761] __x64_sys_symlink+0x79/0xa0 [ 107.545473] do_syscall_64+0xbf/0x420 [ 107.546210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.546754] RIP: 0033:0x7f6b93245427 [ 107.547114] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 107.548595] RSP: 002b:00007ffe264f0528 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 [ 107.549206] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6b93245427 [ 107.549814] RDX: 00007ffe264f0607 RSI: 00007f6b932a0019 RDI: 00007ffe264f05f0 [ 107.550379] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffe264f03c0 [ 107.550986] R10: 00007ffe264f0277 R11: 0000000000000206 R12: 0000000000000001 [ 107.551584] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe264f05f0 [ 107.554013] [ 107.554202] irq event stamp: 823 [ 107.554510] hardirqs last enabled at (823): [] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 107.555296] hardirqs last disabled at (822): [] _raw_spin_lock_irqsave+0x53/0x60 [ 107.556089] softirqs last enabled at (818): [] do_softirq+0x48/0x80 [ 107.556816] softirqs last disabled at (157): [] do_softirq+0x48/0x80 [ 107.557532] ---[ end trace 0000000000000000 ]--- 14:12:49 executing program 0: sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x4e}]}, 0x44}, 0x1, 0x0, 0x0, 0xc840}, 0x800) socketpair(0x1d, 0x80001, 0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffff9}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x20000000) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280), 0x40083, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r2, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c004}, 0x2044890) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r2, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x401}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), r0) sendmsg$WG_CMD_GET_DEVICE(r3, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x7c, r4, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x100}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x1}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e23}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4c841}, 0x20008041) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_PRIVATE_KEY={0x24}]}, 0x50}}, 0x58000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r5, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x50, r2, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8050) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000900)={{0x1, 0x2, 0x3, 0x2, 0x4}, 0x5, 0x914e, 'id1\x00', 'timer1\x00', 0x0, 0x200, 0x31fd, 0x7, 0x3}) r6 = socket(0x1, 0x8000a, 0x3f) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a00), r6) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x3c, r2, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x53}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4004040) r7 = inotify_init1(0x80000) r8 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x800) inotify_rm_watch(r7, r8) 14:12:49 executing program 6: r0 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0xffff}, 0x4) r1 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @broadcast}, &(0x7f00000000c0)=0xc) accept$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) geteuid() ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000180)={0x0, 0x9, 0x6, 0x0, 0xd}) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000200)={{0x2, 0x4e23, @remote}, {0x1}, 0x10, {0x2, 0x4e24, @empty}, 'veth0_to_team\x00'}) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000280)=0x1) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r3, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7b2c}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xff9}, @BATADV_ATTR_VLANID={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008010}, 0x40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x24, r5, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x20b}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xc001}, 0xc010) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30a) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x24, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000000) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0xde, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7fffffff}]}, 0x40}, 0x1, 0x0, 0x0, 0x48081}, 0x4000) 14:12:49 executing program 1: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)="58f3eb2e4a66062ea8762f12a40d6289acefe5be2522e4725347eda6247b3fc8172fa9484bc97effe1ee64ed", 0x2c) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000000c0)) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x80) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r1, 0x80585414, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000001c0)={{0xffffffffffffffff, 0x2, 0x6, 0x2, 0x7}, 0x6, 0x1}) write$cgroup_devices(r0, &(0x7f0000000240)={'b', ' *:* ', 'm\x00'}, 0x8) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000280)=@gcm_128={{0x303}, "0f936e770c6b114e", "1a336e126c052a98bae63b0958499a83", "a3fd997a", "1f26b9ba24ce147f"}, 0x28) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x4401, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000300)) r3 = accept4$inet(r0, &(0x7f0000000340)={0x2, 0x0, @multicast1}, &(0x7f0000000380)=0x10, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f00000004c0)={'broute\x00', 0x0, 0x3, 0x52, [0x4, 0x4, 0x7, 0x7f, 0x7, 0x37], 0x5, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], &(0x7f0000000440)=""/82}, &(0x7f0000000540)=0x78) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ipvlan0\x00', @link_local}) pipe2(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000600)={0xffffffffffffffff, 0x3, 0x3}) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000640)="8e7f6f1b34c037e8bbf891d5894742812de562c7d0ebd371fe68bd1724c31805c53141956ffbb286b930e48488ea472ebddaafbff2e26ee68e797159a05fba3ff5989f235a9b8fa271b1d717fbacc73e7bcf151bdfabbeb79c341a7fd7c64d4477ab2836736e9ac759a53a0d75b45473395911dddcf2ecedbe9a4e039c1bdf2add3b271d79229e483cea69056d0a9b2e251f3a6afe45ed15aa1d49f61aa2bebafdff306a607e58d91a33207913e1e99ed959679300a95a030de2", 0xba) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f0000000700)=0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000780)={'veth0_to_batadv\x00', @remote}) 14:12:49 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0xc300, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x2, 0x8, 0x2, 0x0, 0xd}) write$tun(0xffffffffffffffff, &(0x7f0000000140)={@void, @val={0x1, 0x87, 0x9d38, 0xff, 0x9, 0x7fff}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x9, @multicast, @remote, @random="669e125b6185", @mcast2}}, 0x3e) setsockopt$inet6_tcp_buf(r1, 0x6, 0xd, &(0x7f0000000180)="9df677be5ced515d60e94be74b8831dc353ee8c29aeee09b7fdd32f69362beace11c51d20fc43d108c57f99601bb4b7ab05cd66a966c0e6031c17d98c723d4950a3a9fda724cc91b0c74f9de17a9d6a414a25ec98d1a36725497b60d1c05ecb3c0464e6d2b83d9436aca516d2a802b3844049fa40d2554f7000694a1f517ba2f62ce83e57b2aed6753567b2761af337e", 0x90) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000280)={'netpci0\x00'}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000300)={0x2, &(0x7f00000002c0)=[{0x2, 0x0, 0x1f, 0x52}, {0x7f, 0x1, 0x8, 0x4}]}) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000340)={{0x2, 0x4e23, @private=0xa010102}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x48, {0x2, 0x4e21, @loopback}}) socket(0x10, 0x4, 0x81) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x80, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000400)={'bond0\x00'}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000580)={0x18, 0x0, &(0x7f0000000480)=[@acquire, @acquire, @release], 0xa8, 0x0, &(0x7f00000004c0)="49a64a41b643f49e0e04b66f57270f6e7976390d2a51404e92e479f91cb921fcc7756d077bc838851484be3f6cb7a2a4b2e7d6702ca97568d40f2e6069400b9f9737f56437dee8cc5580126f59e32a318a214ab74ae5f4c7803d80b4b5cf5ba7d5f10f928db16385db9a8906258feadd65a0483260ca389f500ddd94c61654412f7fc8d8e0c4100a822dfe9e7655e3a18cf4aed8254caa78e6469f6ec1476b70110d8e8fabb2b8f9"}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000005c0)=""/148, 0x94, 0x0, &(0x7f0000000680)=""/3, 0x3}, &(0x7f0000000700)=0x40) 14:12:49 executing program 4: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x1c}}, 0x20000080) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x5c, r1, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x30004010}, 0xc054) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x6, 0x6200) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, 0xffffffffffffffff) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x80a00) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000380)={0xffffffffffffffff, 0x1, 0x7, 0x0, 0xbf2}) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x80000001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f0000000580)={&(0x7f00000004c0), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r1, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008084}, 0x20000000) socket$inet_icmp(0x2, 0x2, 0x1) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r1, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48844}, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f00000006c0)={0x0, {}, 0x0, {}, 0x8, 0x1, 0x14, 0x0, "c5c6bfafb99aed3ec5bbb3fa02a29b4175a7321abd49e8a8a9c93c8bf844da6a4cbfb13372f46f06fbea653b858d18140c9e1d8e130e12c9ca0a4b7aaae01c3c", "58fb052d054728b185bf1d1dd8fffcaa35db09225a6d1f651783a3fd916eebb3", [0x6, 0x3]}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x14, r0, 0x10, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x10000}, 0x800) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$inet(r4, &(0x7f0000000880)={0x2, 0x0, @local}, &(0x7f00000008c0)=0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000900), 0xffffffffffffffff) getpeername$inet(0xffffffffffffffff, &(0x7f0000000940)={0x2, 0x0, @initdev}, &(0x7f0000000980)=0x10) 14:12:49 executing program 2: setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_macvtap\x00'}, 0x18) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x25, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @multicast1}, 0xc) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'tunl0\x00', 0x4}, 0x18) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x14fa4000, 0x2e, 0x80, 0x0, 0xbf26]}, &(0x7f0000000280)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f00000002c0)=0x2, 0x4) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) getpeername$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, &(0x7f00000003c0)=0x10) getsockname$inet(r1, &(0x7f0000000400)={0x2, 0x0, @private}, &(0x7f0000000440)=0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@private, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private1}}, &(0x7f00000005c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000600)={@rand_addr=0x64010100, @multicast1, r2}, 0xc) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000640)={'nat\x00', 0x0, 0x0, 0x0, [0x4, 0x1, 0x10001, 0x7]}, &(0x7f00000006c0)=0x78) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000700), 0x4001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000940)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/223, 0xdf, 0x1, &(0x7f0000000840)=""/198, 0xc6}, &(0x7f0000000980)=0x40) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000009c0)={{0x2, 0x4e21, @rand_addr=0x64010102}, {0x306}, 0x8, {0x2, 0x4e24, @remote}, 'bond_slave_1\x00'}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000a40)={0x0, @local, @broadcast}, &(0x7f0000000a80)=0xc) 14:12:49 executing program 7: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'netpci0\x00'}) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x400080, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x404840, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0xf) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x3, 0x2, 0x80, 0x2, 0xffff}, 0x3, 0x8, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)={'vxcan1\x00'}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x34, r3, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0xc) ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f00000004c0)=0x1) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x100) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{0x0, 0x7, 0x2, 0x81}, {0x7f, 0x0, 0xff, 0xae0}, {0x100, 0x3, 0x7, 0x4}, {0xe45, 0x2, 0x9, 0xff}, {0x329e, 0x20, 0x7, 0x896}, {0x6, 0x81, 0xff, 0x4}]}) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, &(0x7f00000005c0)) 14:12:49 executing program 5: setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000), 0x4) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7f, 0x9, 0x0, 0x6, 0x9, 0x4, "01e2cb1d614af59fdb78b92feccab9eafe47ad00741aee5f90f4a04d5c3e71a70e49a85db1cdcfa53dde76ebaba247fedbc6b56df23a6b34b2e4527f1121365b", "d799ce08e38dd66548a799e6f72ee22348cf2cb435a0f60f0548cd2a254126df525542757f9719344eb2e17445d8be625963ce6fbb222248aef8bdef728cb7ce", "2ccda8522685eac48fb6b78433386623bfb51ec9910cd6615a0c703f7dac8685", [0x1812, 0x3]}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x420001, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000180)={0x0, {{0x2, 0x4e20, @rand_addr=0x64010100}}, {{0x2, 0x4e24, @remote}}}, 0x108) r1 = getuid() setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@rand_addr=0x64010102, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x8, 0x4e22, 0x1, 0xa, 0xa0, 0x0, 0x2f, 0x0, r1}, {0x10000, 0x3e0000000, 0xfffffffffffffe00, 0x7, 0x10001, 0xfff}, {0x0, 0x6d907cdc, 0x30f, 0x10001}, 0xffffffff, 0x6e6bb0, 0x0, 0x0, 0x3, 0x1}, {{@in6=@private0, 0x4d5, 0x2b}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x3503, 0x0, 0x2, 0x0, 0xffffb1f3, 0x800, 0x9}}, 0xe8) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffff000}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r4, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xbec}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000640), 0x4) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "38afac8cbc47e00b", "7674cda1da71358e2fccea22ac864c44", "4946ab32", "71ab904e1f783560"}, 0x28) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f00000006c0)) pipe2(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r7, 0x54a2) getsockopt$inet_tcp_int(r6, 0x6, 0x7, &(0x7f0000000740), &(0x7f0000000780)=0x4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000007c0), 0x4) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r2, 0x80083314, &(0x7f0000000800)) prctl$PR_SET_FP_MODE(0x2d, 0x3) VM DIAGNOSIS: 14:12:41 Registers: info registers vcpu 0 RAX=dffffc0000000000 RBX=ffffffff84ce0a1f RCX=0000000000000001 RDX=1ffff11007a50f47 RSI=ffffffff8135f952 RDI=ffffffff84ce0a1f RBP=ffffffff84ce0a1f RSP=ffff88803d287990 R8 =0000000000000001 R9 =ffff88803d287a20 R10=000000000003d1bb R11=00000000000269af R12=0000000000000001 R13=0000000000000000 R14=ffff8880494d3700 R15=ffff888009823280 RIP=ffffffff8143d612 RFL=00000283 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f22bc897540 00000000 00000000 GS =0000 ffff8880e5342000 00000000 00000000 LDT=0000 fffffe2c00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055968c7ab4c8 CR3=000000000bd4b000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0070656474666f732e73656c75646f6d XMM01=0070656474666f732e73656c75646f6d XMM02=00000000000000000000ffffffffffff XMM03=000000000000000000000000ff000000 XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=676f6c206d6f74737563000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000074 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82977f45 RDI=ffffffff889c1a00 RBP=ffffffff889c19c0 RSP=ffff88804158f488 R8 =0000000000000000 R9 =ffffed1001772046 R10=0000000000000074 R11=666666203a312320 R12=0000000000000074 R13=0000000000000010 R14=ffffffff889c19c0 R15=ffffffff82977f30 RIP=ffffffff82977f9d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555929bc400 00000000 00000000 GS =0000 ffff8880e5442000 00000000 00000000 LDT=0000 fffffe3b00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f6b932a0019 CR3=0000000048055000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11 XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000 XMM04=000000ff0000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000