Warning: Permanently added '[localhost]:12499' (ECDSA) to the list of known hosts. 2025/11/16 18:44:45 fuzzer started 2025/11/16 18:44:45 dialing manager at localhost:37161 syzkaller login: [ 59.629155] cgroup: Unknown subsys name 'net' [ 59.690992] cgroup: Unknown subsys name 'cpuset' [ 59.708103] cgroup: Unknown subsys name 'rlimit' 2025/11/16 18:44:56 syscalls: 200 2025/11/16 18:44:56 code coverage: enabled 2025/11/16 18:44:56 comparison tracing: enabled 2025/11/16 18:44:56 extra coverage: enabled 2025/11/16 18:44:56 setuid sandbox: enabled 2025/11/16 18:44:56 namespace sandbox: enabled 2025/11/16 18:44:56 Android sandbox: enabled 2025/11/16 18:44:56 fault injection: enabled 2025/11/16 18:44:56 leak checking: enabled 2025/11/16 18:44:56 net packet injection: enabled 2025/11/16 18:44:56 net device setup: enabled 2025/11/16 18:44:56 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/11/16 18:44:56 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/11/16 18:44:56 USB emulation: enabled 2025/11/16 18:44:56 hci packet injection: enabled 2025/11/16 18:44:56 wifi device emulation: enabled 2025/11/16 18:44:56 802.15.4 emulation: enabled 2025/11/16 18:44:56 fetching corpus: 0, signal 0/0 (executing program) 2025/11/16 18:44:58 starting 8 fuzzer processes 18:44:58 executing program 0: ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000000)={{0x8, 0x2}, 0x0, 0x4, 0x8001, {0x4, 0x1}, 0x7f, 0x10001}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000080)={{0x7, 0x10}, 'port1\x00', 0xc0, 0x6, 0x6e6, 0x5, 0x0, 0xffffffff, 0x7e, 0x0, 0x2}) r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs, &(0x7f00000001c0)=0x6e, 0x0) connect$unix(r0, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000280)={{0x9, 0xaf}, 'port1\x00', 0x6, 0x0, 0x5, 0x0, 0x3, 0x5, 0x0, 0x0, 0x1, 0x86}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(0xffffffffffffffff, 0x40bc5311, &(0x7f0000000340)={0x4, 0x0, 'client0\x00', 0x1, "d4e67826717d66b8", "647753c9d856ce0871188a010d70a10b821171b642b87134befe4b4c5021f858", 0x101}) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000400), 0x6020c1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000440)={0xe025, 0x0, 0x0, 'queue1\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000500)={0x40, 0x0, 0x8}) setsockopt$inet6_tcp_int(r1, 0x6, 0x16, &(0x7f0000000540)=0x4, 0x4) recvmsg$unix(r1, &(0x7f0000001f00)={&(0x7f0000000780)=@abs, 0x6e, &(0x7f0000001d40)=[{&(0x7f0000000800)=""/66, 0x42}, {&(0x7f0000000880)=""/66, 0x42}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000001900)=""/90, 0x5a}, {&(0x7f0000001980)=""/178, 0xb2}, {&(0x7f0000001a40)=""/194, 0xc2}, {&(0x7f0000001b40)=""/173, 0xad}, {&(0x7f0000001c00)=""/62, 0x3e}, {&(0x7f0000001c40)=""/248, 0xf8}], 0x9, &(0x7f0000001e00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}, 0x100) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r2, 0xc08c5335, &(0x7f0000001f40)={0x7, 0x8000, 0x1, 'queue1\x00', 0x6}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000002000)) connect$unix(r1, &(0x7f0000002040)=@abs={0x1, 0x0, 0x4e21}, 0x6e) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc058534f, &(0x7f00000020c0)={{0x3f, 0x40}, 0x0, 0x4, 0x7, {0x1f, 0x8}, 0xb5, 0x2}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000002140)={0x5, 0x101, 0x1, 'queue0\x00', 0x9}) r5 = accept4$unix(0xffffffffffffffff, &(0x7f0000002200)=@abs, &(0x7f0000002280)=0x6e, 0x0) accept4$unix(r5, &(0x7f00000022c0), &(0x7f0000002340)=0x6e, 0x80000) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f00000023c0)) 18:44:58 executing program 1: r0 = socket(0x25, 0xa, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x883, 0x10001, 0x7fffffff, 0x0, 0x80}, 0x14) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e24, 0x284b3533, @mcast2, 0x6}}, 0x0, 0x0, 0x4f, 0x0, "d7cf0d0f63fa7d121ee520cb53ca49a675fd7f0e340da8ba229af41e161909cfdffb588cbcfe1333a0dc9f67c4b3b85f35ad0fdb59b5b1cda238f4902e74a378cbae6dc52d23fccfdf57ef29e8f57a45"}, 0xd8) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000140)='\x91\x00', 0x0, r0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1c, &(0x7f0000000180)="16ba421fd0953977641f46ab708858693ca5d92392aaeedfd1b14c6feb551ca0108b9cb09d16f75da67cf61cdf0d8c8abcf0ec0ee5782664e62db427e4fdd88a352174d6c2e29def8b61c9ce2ec2f103b7155816fbb7ef54aeb49cc4add8713d2472f9df0ca662836c838d53670a86ddd6558ab6c4c3df9bb914f7fe1d1f1aa746f50f5aabc59ade10042cee27070a4dd8312cf81b92091fd024cd", 0x9b) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) recvmsg$unix(r0, &(0x7f0000000480)={&(0x7f0000000300)=@abs, 0x6e, &(0x7f0000000380), 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x88}, 0x0) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x48, &(0x7f00000004c0)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, r2}}, {@noextend}, {@access_user}, {@noextend}, {@cache_mmap}, {@msize={'msize', 0x3d, 0x7f}}, {@msize={'msize', 0x3d, 0x9}}], [{@mask={'mask', 0x3d, '^MAY_READ'}}, {@hash}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@obj_type={'obj_type', 0x3d, ':'}}]}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000600), r3) sendmsg$TIPC_NL_KEY_FLUSH(r4, &(0x7f0000000800)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000007c0)={&(0x7f0000000640)={0x180, r5, 0x8ef3220435d71c44, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffff9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK={0x124, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffff801}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1eb175c6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1835}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x67b9}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xbe2}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x87f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3d47}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6ec}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8c}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x40080}, 0x2401c018) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x0, 0x20, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x33}, @void, @val={0xc, 0x99, {0x8, 0x47}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000010) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000000b80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000b40)={&(0x7f0000000980)={0x1b8, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x538}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xba2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1f}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x87}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e20, @broadcast}}}}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd97}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_NODE={0xec, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x8f, 0x3, "0d13f91158e70b782cc9535b4bd8c8fb4574463d251b145fa15aef733b5c24ff59f837b9fa891311430ea2d40f22ab7e33cea16305fbd7008963cc2862a7b26f742a54c2a96c06e29b32f378cd53cae5564f6e888f3676611a4fa712f66dbc4a08e1754c45e027e26f5774a95026a754a9029f3e07b117abf846875ec1317844d0798339493210618d2e70"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "b337324f630ce42bc183ec2b16d95784e3e0b274"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9c4b}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x40}, 0x1) recvmsg$unix(r0, &(0x7f0000000f80)={&(0x7f0000000bc0), 0x6e, &(0x7f0000000e80)=[{&(0x7f0000000c40)=""/111, 0x6f}, {&(0x7f0000000cc0)=""/97, 0x61}, {&(0x7f0000000d40)=""/30, 0x1e}, {&(0x7f0000000d80)=""/58, 0x3a}, {&(0x7f0000000dc0)=""/112, 0x70}, {&(0x7f0000000e40)=""/13, 0xd}], 0x6, &(0x7f0000000f00)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x50}, 0x2021) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001000), r3) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r6, &(0x7f00000010c0)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)={0x28, r7, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0xf}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x448c0}, 0x4000) r8 = socket(0x1a, 0x3, 0x7fffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r8, 0x0, 0x63, &(0x7f0000001500)={'TPROXY\x00'}, &(0x7f0000001540)=0x1e) r9 = socket(0x18, 0x4, 0x8) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r9, 0x6, 0x21, &(0x7f0000001580)="819f7c0f74c782e2e30a46be366a80f5", 0x10) 18:44:58 executing program 7: ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000000)) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x561800, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f0000000080)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x16000) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000180)={0x3f}) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000002c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0x17, 0x34, @random="076d2893644d45023447f6cc8ef5f685d35127"}, @NL80211_ATTR_PMKID={0x14, 0x55, "66d4d50814763160675415148e206856"}, @NL80211_ATTR_PMKID={0x14, 0x55, "a1bf2b555913438fcb5407c2ac054333"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x60}, 0x1, 0x0, 0x0, 0x44810}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000300)=""/46) write$sndseq(r0, &(0x7f0000000340)=[{0x2, 0x2, 0xff, 0xa0, @time={0x7fff, 0x3}, {0xf8, 0x20}, {0x3, 0x80}, @raw8={"8eefeeafc0534ca83ce2a2ff"}}, {0xe1, 0x40, 0x3f, 0x0, @tick=0x7, {0x1, 0x9}, {0x5, 0x3}, @raw8={"d2a2276ad6d9f4f1727815be"}}, {0x80, 0x4, 0x0, 0x2, @tick=0x3, {0x9, 0x5}, {0x40, 0x4}, @result={0x3, 0x7f}}, {0x3, 0x5, 0x2, 0x5, @time={0x0, 0x5}, {0x0, 0x76}, {0x0, 0x3f}, @raw8={"821bea31888056ab26875cdc"}}, {0x9, 0xff, 0x2a, 0x7f, @tick=0x3, {0x3, 0x1}, {0x1, 0x8}, @time=@tick=0xffff8000}, {0x0, 0x1, 0xc4, 0x6, @tick, {0x0, 0x3}, {0x80, 0xe1}, @raw8={"5732ebabdb6dbd8349fdd443"}}], 0xa8) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_FLUSH(r2, &(0x7f0000000580)={&(0x7f0000000400), 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xf8, 0x0, 0x2, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'sit0\x00'}}]}, @TIPC_NLA_MEDIA={0x50, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xbaf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb762}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3ff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3a5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10000}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4e0}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x40000) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f00000005c0)={{0x50, 0x1}, 'port1\x00', 0x20, 0xe78a0d3233d1b248, 0x4, 0x6, 0x1, 0x5, 0x5, 0x0, 0x1, 0xf9}) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x20, 0x0, 0x20, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1ff, 0x2}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x400c001}, 0x4000000) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000780), 0x400240, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000800), r2) sendmsg$TIPC_NL_LINK_RESET_STATS(r3, &(0x7f0000000ac0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000840)={0x238, r4, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x4}, @TIPC_NLA_LINK={0x124, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x22bd7c5}]}]}, @TIPC_NLA_MEDIA={0x80, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xca9a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f9b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6a1}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x78, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe26}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x58, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}]}, @TIPC_NLA_NODE={0x4}]}, 0x238}, 0x1, 0x0, 0x0, 0x4000}, 0x8850) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f0000000bc0)={'syztnl1\x00', &(0x7f0000000b40)={'ip6tnl0\x00', 0x0, 0x2f, 0x4, 0x1f, 0x401, 0x79, @mcast2, @loopback, 0x8048, 0x8, 0x6, 0x1ff}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f0000000c80)={'ip6gre0\x00', &(0x7f0000000c00)={'syztnl1\x00', 0x0, 0x2f, 0x7f, 0x0, 0x8, 0x59, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x1, 0x700, 0x7ff, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000d40)={'syztnl1\x00', &(0x7f0000000cc0)={'sit0\x00', 0x0, 0x2f, 0xff, 0x6, 0x8, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8, 0x40, 0x80000000, 0x9}}) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000001380)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001340)={&(0x7f0000000e40)={0x4ec, 0x0, 0x100, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x1a8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r5}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x3, 0x7, 0x4, 0x5}, {0x0, 0x5, 0x6, 0x4}, {0x1, 0x1, 0x5, 0x7}, {0xb1, 0x91, 0x81, 0x6}, {0x0, 0xf5, 0x1f, 0x40}]}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0xc4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}]}}, {{0x8}, {0x88, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7f}}}]}}, {{0x8}, {0xb8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}]}, 0x4ec}, 0x1, 0x0, 0x0, 0x20000004}, 0x4) 18:44:58 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x80000000, 0x60080) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000040)=""/250) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000140)=""/96) r1 = socket(0x892f0db8ddfdddc2, 0x80000, 0x5) getsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000240)=""/145) r2 = syz_open_dev$evdev(&(0x7f0000000300), 0x0, 0x600) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000340)=""/4096) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000001340)={0x51, 0x9, 0x1ff, {0x1000, 0x6f26}, {0x9, 0x67d}, @cond=[{0xfff7, 0x1, 0x5, 0x1ff, 0x0, 0x5}, {0x5, 0x0, 0xd8, 0x2e, 0x9, 0x9}]}) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f00000013c0)={0x14, 0x1b, &(0x7f0000001380)="9dafcdbcdf80b3d1c9175e7187622e2014f8f086b2a52d06ea6a08"}) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001500)={&(0x7f0000001440)={0x94, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:logrotate_var_lib_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ipvlan0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private=0xa010100}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x35}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @broadcast}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) connect$unix(r1, &(0x7f0000001580)=@file={0x0, './file0\x00'}, 0x6e) clock_gettime(0x0, &(0x7f0000001600)={0x0, 0x0}) setitimer(0x1, &(0x7f0000001640)={{r3, r4/1000+10000}, {0x0, 0x2710}}, &(0x7f0000001680)) r5 = openat$hpet(0xffffffffffffff9c, &(0x7f00000016c0), 0x40000, 0x0) ioctl$EVIOCGABS3F(r5, 0x8018457f, &(0x7f0000001700)=""/187) clock_getres(0x4, &(0x7f00000017c0)) r6 = syz_open_dev$evdev(&(0x7f0000001800), 0x100, 0x44501) ioctl$EVIOCGKEYCODE(r6, 0x80084504, &(0x7f0000001840)=""/180) syz_genetlink_get_family_id$nl80211(&(0x7f0000001900), 0xffffffffffffffff) 18:44:58 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x124, r1, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0xd8, 0xc, 0x0, 0x1, [{0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x38bc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x37ba4f9b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd420}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6f05}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x45d8f765}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d67a44e}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xcabf669}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71cd00f6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5f2e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b9c38a2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x672a5cae}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3d68e8b7}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2f0c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6f4d}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x103c99e7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d4691de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1a96}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x477a559b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x73845403}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4eb1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3def19cd}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4ef0b311}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc054}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x620a}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x124}, 0x1, 0x0, 0x0, 0x4000010}, 0x840) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r1, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x20, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2e2cc270}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x912d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x468b}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040800}, 0x20004004) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x0, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040810}, 0x84) recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000480)=@abs, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000500)=""/87, 0x57}, {&(0x7f0000000580)}, {&(0x7f00000005c0)=""/10, 0xa}], 0x3, &(0x7f0000000640)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x80}, 0x100) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000440), r6) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000000940)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000780)={0x148, r9, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x74, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x728}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfc0}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7fff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xff}]}, @TIPC_NLA_MEDIA={0x84, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4004044}, 0x24044001) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000009c0), r4) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r5, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x40, r10, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x50a, 0x26}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x14, 0x33, @ctrl_frame=@cf_end={{}, {0x6}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_REMOVE(r11, &(0x7f0000000d80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000b00)={0x20c, 0x0, 0x8, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x140, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9758}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x60e30a79}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x14d2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bed9c69}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1243d503}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x32f75402}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1f357bdc}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40ce6c64}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7b531d94}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9e35}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6a81bd98}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe870}]}, {0x54, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42afc90c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x611d1ed1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x24d4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8c61}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5c4b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59962d91}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3ee10e05}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x38904099}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x26629ce0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xeaa812d}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x35b1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59d837d2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc55}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8d38}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe0ba}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x92eb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2b58984c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc168}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b4406ad}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9ab7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5d73d6d3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x48c850db}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9c7f}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x68, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x62f0cb6c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x83a21ec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x681c726a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x293e317d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2a03657b}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3501f184}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x45f9b44b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x74}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xb361e86}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}]}]}, 0x20c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) sendmsg$NL80211_CMD_GET_KEY(r7, &(0x7f0000000e80)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x38, r10, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "d75b7359d802418469c1619abf"}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r12, &(0x7f0000001080)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0xffb0011a454e4f7c}, 0xc, &(0x7f0000001040)={&(0x7f0000000f00)={0x12c, r1, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0x98, 0xc, 0x0, 0x1, [{0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa384}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7d32}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x97d66ca}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7daaba1c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4bf75dfc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7dc5}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x36be2e34}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21827b7c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x455648b9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5c35}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6de19faa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8b5d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6b05}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x25d6}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd77}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x89f9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x584bd4cd}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x70, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3cd8581b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x86}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2a0711df}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x99}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x42f48ce8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x252061bf}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xbd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ca652cd}]}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x2c048084}, 0x24000010) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001380)={&(0x7f0000001180)={0x1c8, r8, 0x20, 0x70bd29, 0x25dfdbfd, {}, [{{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xd2}}}]}}, {{0x8}, {0x128, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x925e, 0x7f, 0xef, 0x1c}, {0x1, 0x9, 0xc1, 0xfffffffb}]}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x800}, 0x80) [ 70.921157] audit: type=1400 audit(1763318698.303:7): avc: denied { execmem } for pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 18:44:58 executing program 4: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x9080, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0x7ff, 0xff, 0x5, 0x2ff3, 0x3, 0x81}) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000080)={0xfd2, 0x0, 0xfffffffc, 0x21, 0x0, 0x6}) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000000c0)="a2388dab471aba4f69406313ea272b83", 0x10) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)={'filter\x00', 0x0, 0x0, 0x0, [0x7, 0x5, 0x6, 0x1, 0x9, 0x100000000]}, &(0x7f0000000180)=0x78) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000280)={0x5, 0x7f, &(0x7f0000000200)="99aa2ad6dd19cb5d94770f47635152a0568fdc2339b61ddbec6f134bc19a17d33b094afe26032d4c68d538ad42cc67d5a2be4aff25197c919afb49bda52385822ca5f3a0cef54ddef98917ef0876d1cadf3afd8ccf182ce661d7eb2634779553f97bbecce1501279c2f4663a4df75834c2fcf8f817e57b8e9bf66b85c6732f"}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r2, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x20008032) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f00000004c0)={&(0x7f0000000400), 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc}, 0x14}}, 0x40801) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/194, 0xc2, 0x1, &(0x7f0000000600)=""/155, 0x9b}, &(0x7f0000000700)=0x40) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000740)={0x3, 0xd2, 0x3, 0x4, 0x3, 0x7fffffff}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f00000007c0)=""/247) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f00000008c0)={0x2, 0x7, 0x10000, 0x80000001, 0x8000, 0x8}) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000900)=""/126) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000980)=""/184) sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000d80)={&(0x7f0000000a80)={0x2fc, r4, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x1ac, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xa2, 0x3, "71c0f23100838c24ce83063051708d80916bc5529d83b6ae0fa7152137d26785a9bd820183e3d2442cdc2abf0bd8fae55f8df009a3f2da90c06dee36facf72fd3cbe77332cce1b05ded6c524f8072847cd04b0d3c73c693c8de44def3495d0aa8f4f3dfef111548bb90a37f7e50db1755ddd85e20dc78df20a4e0394fa0f8141c8190b5ef197e7aee2aa2c70e6c8dda1864bf83afba1c753cbea21b88c5f"}, @TIPC_NLA_NODE_ID={0xf2, 0x3, "8384adf90ffd9d27a23ebe4a3644442cdc2566255fa40b954faa26fb5fa2c2dc1b25ce14ba411af06b6a23a2f67b732046512307451e7c29dcb80cbfd0d6fe4190fb0dec05598ca7cf3cb6059a2c177e62c4332ff1d94ca3273ec396451f66abc7ad45745f827970942057ac0b2846c377992b87c44797de63f1ae442ba782433faf2535f1dd7a4caafc18ed114a5f297fe71e47f7d89b96054d8cad4bbb1f3014da915a6061d609fa1f26f852a4efcab8cf5a47705fb3a2885f317ee38edd5ea16e278e58e40448d4113b74dd349fd20ef159a8b0c4e16db83ec1f74bac310e7c3a7310b915c4fb001e48d44f40"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x57}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x599}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc498}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x15b}]}]}, @TIPC_NLA_BEARER={0x70, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x2b5e1792, @dev={0xfe, 0x80, '\x00', 0x22}, 0xf1b}}, {0x14, 0x2, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_MEDIA={0x50, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}]}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}]}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x8004}, 0x1d0) 18:44:58 executing program 6: ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, &(0x7f0000000000)=""/63) sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x101, 0x2e}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40010) r0 = socket(0x26, 0x800, 0x80) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x0, 0x2, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x28}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x29}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x42}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x26}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040080}, 0x880) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000240)=""/141) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000340)='\x00', 0x0, r0) fsopen(&(0x7f0000000380)='incremental-fs\x00', 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000840), 0x58100, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000880)='dctcp\x00', 0x6) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000a00)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f00000008c0)=""/109, 0x6d, 0x0, &(0x7f0000000940)=""/183, 0xb7}, &(0x7f0000000a40)=0x40) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_P2P_DEVICE(r3, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x1c, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000044}, 0x80) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000bc0)={{{@in6=@mcast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000cc0)=0xe8) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r3, &(0x7f0000000e00)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d00)={0xb8, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000e40)=""/247) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000f40)) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000fc0), r3) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001000)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000001ec0)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001e80)={&(0x7f00000014c0)={0x988, r5, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [{{0x8, 0x1, r6}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x72ee}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x140, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r4}}, {0x8}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x7, 0x6, 0x4, 0x7}, {0xa400, 0x3, 0x9}, {0x5, 0x3d, 0x0, 0x89}]}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x2578}}}]}}, {{0x8, 0x1, r4}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfc0}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r1}, {0x250, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r4}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xd5}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r4}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x85e}}}]}}, {{0x8, 0x1, r1}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2a}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8001}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x78, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r1}, {0x170, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xfffffff9}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0xf8, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x133}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}]}}]}, 0x988}}, 0x90) 18:44:58 executing program 5: sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000040)={0x44c, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9be}]}, @TIPC_NLA_BEARER={0x2c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvlan0\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x151}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffffc500}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6d}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x55bf}]}, @TIPC_NLA_BEARER={0xb0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x800}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}]}]}, @TIPC_NLA_BEARER={0xfc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x16, 0x1, @l2={'eth', 0x3a, 'veth1_to_bond\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6805}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xaa1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x39}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x80000001, @private0, 0x8}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7f}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x8, @remote, 0x7}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x7f, @private2={0xfc, 0x2, '\x00', 0x1}}}}}]}, @TIPC_NLA_BEARER={0xd4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x345c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff80}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'xfrm0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvlan0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x14, 0x2, @in={0x2, 0x4e22, @remote}}}}]}, @TIPC_NLA_LINK={0xc0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff98a5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb93}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2d06257b}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}, @TIPC_NLA_LINK={0x40, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}]}]}]}, 0x44c}}, 0x20004000) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000540), 0x1e1180, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000600)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000005c0)={0xfffffffffffffffc}, 0x1, 0x0, 0x0, 0x20040011}, 0x811) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000680)={{{@in6=@private2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000780)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000840)={'syztnl2\x00', &(0x7f00000007c0)={'ip6tnl0\x00', 0x0, 0x29, 0x7, 0x7, 0x400, 0x20, @loopback, @mcast1, 0x8000, 0x8000, 0x10001, 0x8}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000880)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000940)={'syztnl1\x00', &(0x7f00000008c0)={'syztnl1\x00', 0x0, 0x4, 0x80, 0x8, 0x53b3, 0x10, @local, @empty, 0x8, 0x40, 0x101, 0x40}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000a00)={'sit0\x00', &(0x7f0000000980)={'syztnl1\x00', 0x0, 0x29, 0x3, 0xb4, 0x5, 0x18, @private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x7800, 0x10, 0x1, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000ac0)={'syztnl0\x00', &(0x7f0000000a40)={'ip6gre0\x00', 0x0, 0x4, 0x9f, 0x20, 0xa, 0x0, @loopback, @remote, 0x1, 0x1, 0x9, 0x33}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000c00)={'syztnl1\x00', &(0x7f0000000b00)={'gretap0\x00', 0x0, 0x1, 0x7800, 0x9, 0x3ff, {{0x37, 0x4, 0x0, 0x1, 0xdc, 0x65, 0x0, 0x29, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, {[@end, @noop, @generic={0x88, 0x11, "3e639fea73a43eeef165e51aaa7045"}, @ssrr={0x89, 0xf, 0xe0, [@multicast2, @broadcast, @local]}, @cipso={0x86, 0x68, 0x3, [{0x6, 0x3, ':'}, {0x2, 0x7, "9ac27e54fc"}, {0x5, 0x11, "47cbb899e594ad0db89dc130af0874"}, {0x2, 0xf, "12eed572fa6491226166e7e2e9"}, {0x6, 0x6, "207d8b29"}, {0x5, 0x11, "562ec24d73c959c3de77bd043f2932"}, {0x5, 0xf, "bb9a3f24d6d1277d9e02316b92"}, {0x6, 0x12, "f93c2c60e62cb2cf402b63998555c050"}]}, @timestamp_addr={0x44, 0x3c, 0xee, 0x1, 0x9, [{@local, 0x101}, {@broadcast, 0xfffffc01}, {@private=0xa010102, 0x80000000}, {@broadcast, 0x700ec8cb}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@multicast2, 0xee4}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0x1}]}]}}}}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000c40)={{{@in6=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000d40)=0xe8) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000e00)={'ip6_vti0\x00', &(0x7f0000000d80)={'ip6_vti0\x00', 0x0, 0x29, 0xab, 0xff, 0x933d, 0x40, @ipv4={'\x00', '\xff\xff', @local}, @mcast1, 0x8000, 0x1, 0x7fff, 0x101}}) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f00000016c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001680)={&(0x7f0000000e40)={0x82c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8}, {0x160, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x511}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x18c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0xcadf, 0x81, 0x0, 0x3f}, {0xffff, 0x7f, 0xdb, 0xffffffff}, {0xac8, 0xca, 0x5, 0x1}, {0x9, 0x9, 0x8, 0x4}, {0x8000, 0x1f, 0x3, 0x2}]}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r4}, {0x254, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xd4b9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x134, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}]}, 0x82c}, 0x1, 0x0, 0x0, 0x19}, 0x4044000) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f00000017c0)={'ip6tnl0\x00', &(0x7f0000001740)={'ip6gre0\x00', r3, 0x4, 0x3, 0x7f, 0xc48, 0x1, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x80, 0x400, 0x1000}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000001880)={'syztnl0\x00', &(0x7f0000001800)={'syztnl2\x00', r5, 0x29, 0xff, 0x5, 0x0, 0x42, @ipv4={'\x00', '\xff\xff', @multicast2}, @mcast1, 0x8000, 0x40, 0x9, 0x2}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001940)={'gretap0\x00', &(0x7f00000018c0)={'syztnl1\x00', r1, 0x1, 0x40, 0x0, 0x3, {{0xc, 0x4, 0x0, 0x6, 0x30, 0x65, 0x0, 0x3, 0x2f, 0x0, @rand_addr=0x64010100, @multicast1, {[@generic={0x94, 0x6, "a39787ad"}, @timestamp_prespec={0x44, 0x14, 0x43, 0x3, 0x1, [{@remote, 0x2}, {@local, 0xef0}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000001a00)={'ip6tnl0\x00', &(0x7f0000001980)={'ip6_vti0\x00', 0x0, 0x4, 0x7f, 0x20, 0xffff, 0x5, @empty, @empty, 0x40, 0x1, 0x80000001, 0xffffffff}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001a40)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001a80)={{{@in=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002bc0)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002b80)={&(0x7f0000001f80)={0xbe8, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {}, [{{0x8, 0x1, r10}, {0x12c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}]}}, {{0x8, 0x1, r5}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r11}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}]}}, {{0x8, 0x1, r12}, {0x174, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3f}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r13}}, {0x8}}}]}}, {{0x8, 0x1, r14}, {0x214, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r3}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x10001}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1c62}}}]}}, {{0x8, 0x1, r15}, {0xf4, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r5}, {0xc0, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6e2}}}]}}, {{0x8, 0x1, r8}, {0x218, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r5}, {0x1dc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0xbe8}}, 0x4000) [ 72.093389] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.095935] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.099398] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.102565] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.107482] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.108739] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.112323] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.114262] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.117526] ================================================================== [ 72.118815] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x66d/0x6d0 [ 72.119990] Read of size 2 at addr ffff88800aa617b8 by task kworker/u11:2/291 [ 72.122487] [ 72.123430] CPU: 0 UID: 0 PID: 291 Comm: kworker/u11:2 Not tainted 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary) [ 72.123480] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 72.123503] Workqueue: hci1 hci_cmd_work [ 72.123551] Call Trace: [ 72.123564] [ 72.123577] dump_stack_lvl+0xca/0x120 [ 72.123623] print_report+0xcb/0x610 [ 72.123669] ? __virt_addr_valid+0x100/0x5d0 [ 72.123711] ? hci_cmd_work+0x66d/0x6d0 [ 72.123756] ? hci_cmd_work+0x66d/0x6d0 [ 72.123802] kasan_report+0xca/0x100 [ 72.123848] ? hci_cmd_work+0x66d/0x6d0 [ 72.123900] hci_cmd_work+0x66d/0x6d0 [ 72.123949] process_one_work+0x8e1/0x19c0 [ 72.124011] ? __pfx_process_one_work+0x10/0x10 [ 72.124062] ? move_linked_works+0x172/0x270 [ 72.124103] ? assign_work+0x196/0x240 [ 72.124154] worker_thread+0x67e/0xe90 [ 72.124206] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 72.124250] ? __pfx_worker_thread+0x10/0x10 [ 72.124302] kthread+0x3c8/0x740 [ 72.124348] ? __pfx_kthread+0x10/0x10 [ 72.124392] ? ret_from_fork+0x79/0x7a0 [ 72.124427] ? lock_release+0xc8/0x290 [ 72.124482] ? __pfx_kthread+0x10/0x10 [ 72.124529] ret_from_fork+0x67a/0x7a0 [ 72.124565] ? __pfx_ret_from_fork+0x10/0x10 [ 72.124603] ? __switch_to+0x759/0x1060 [ 72.124651] ? __pfx_kthread+0x10/0x10 [ 72.124698] ret_from_fork_asm+0x1a/0x30 [ 72.124758] [ 72.124770] [ 72.150358] Allocated by task 288: [ 72.150977] kasan_save_stack+0x24/0x50 [ 72.151666] kasan_save_track+0x14/0x30 [ 72.152350] __kasan_slab_alloc+0x59/0x70 [ 72.153067] kmem_cache_alloc_node_noprof+0x228/0x6b0 [ 72.153978] __alloc_skb+0x2ab/0x370 [ 72.154630] hci_cmd_sync_alloc+0x34/0x300 [ 72.155366] __hci_cmd_sync_sk+0xf7/0x5c0 [ 72.156089] hci_read_dev_class_sync+0x2c/0x170 [ 72.156888] hci_dev_open_sync+0x1874/0x1f60 [ 72.157649] hci_power_on+0xdb/0x5d0 [ 72.158318] process_one_work+0x8e1/0x19c0 [ 72.159049] worker_thread+0x67e/0xe90 [ 72.159730] kthread+0x3c8/0x740 [ 72.160324] ret_from_fork+0x67a/0x7a0 [ 72.161002] ret_from_fork_asm+0x1a/0x30 [ 72.161706] [ 72.162022] Freed by task 293: [ 72.162548] kasan_save_stack+0x24/0x50 [ 72.163101] kasan_save_track+0x14/0x30 [ 72.163653] kasan_save_free_info+0x3a/0x60 [ 72.164263] __kasan_slab_free+0x43/0x70 [ 72.164840] kmem_cache_free+0x26f/0x500 [ 72.165409] kfree_skbmem+0x18a/0x1f0 [ 72.165954] sk_skb_reason_drop+0x10e/0x1b0 [ 72.166553] vhci_read+0x3d5/0x5d0 [ 72.167060] vfs_read+0x1eb/0xc70 [ 72.167548] ksys_read+0x121/0x240 [ 72.168044] do_syscall_64+0xbf/0x430 [ 72.168577] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.169295] [ 72.169541] The buggy address belongs to the object at ffff88800aa61780 [ 72.169541] which belongs to the cache skbuff_head_cache of size 232 [ 72.171290] The buggy address is located 56 bytes inside of [ 72.171290] freed 232-byte region [ffff88800aa61780, ffff88800aa61868) [ 72.172959] [ 72.173216] The buggy address belongs to the physical page: [ 72.174020] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaa61 [ 72.175138] memcg:ffff88800a1a7481 [ 72.175643] anon flags: 0x100000000000000(node=0|zone=1) [ 72.176412] page_type: f5(slab) [ 72.176903] raw: 0100000000000000 ffff8880096c78c0 0000000000000000 dead000000000001 [ 72.178027] raw: 0000000000000000 00000000000c000c 00000000f5000000 ffff88800a1a7481 [ 72.179137] page dumped because: kasan: bad access detected [ 72.179934] [ 72.180189] Memory state around the buggy address: [ 72.180883] ffff88800aa61680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.181920] ffff88800aa61700: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 72.182958] >ffff88800aa61780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.183994] ^ [ 72.184722] ffff88800aa61800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 72.185760] ffff88800aa61880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 72.186794] ================================================================== [ 72.187990] Disabling lock debugging due to kernel taint [ 72.191293] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.198000] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.281847] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.283040] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 72.290017] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.300922] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.302985] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.304526] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.305975] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.310073] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.312080] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.315804] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 72.319880] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.324809] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 72.326355] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 72.328657] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.330361] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 72.331675] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 72.333070] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.336499] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 72.341902] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 72.342905] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 72.344454] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 72.347357] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 72.347844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.358898] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 72.362636] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 72.364474] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 72.368038] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 72.369611] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 72.372561] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 72.377017] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 74.248748] Bluetooth: hci0: command tx timeout [ 74.250149] Bluetooth: hci1: command tx timeout [ 74.376746] Bluetooth: hci3: command tx timeout [ 74.377181] Bluetooth: hci2: command tx timeout [ 74.377557] Bluetooth: hci4: command tx timeout [ 74.440757] Bluetooth: hci7: command tx timeout [ 74.441815] Bluetooth: hci6: command tx timeout [ 74.442197] Bluetooth: hci5: command tx timeout [ 76.296760] Bluetooth: hci1: command tx timeout [ 76.296780] Bluetooth: hci0: command tx timeout [ 76.426731] Bluetooth: hci4: command tx timeout [ 76.426759] Bluetooth: hci2: command tx timeout [ 76.427159] Bluetooth: hci3: command tx timeout [ 76.489728] Bluetooth: hci6: command tx timeout [ 76.489749] Bluetooth: hci5: command tx timeout [ 76.490140] Bluetooth: hci7: command tx timeout [ 78.345078] Bluetooth: hci1: command tx timeout [ 78.345215] Bluetooth: hci0: command tx timeout [ 78.472759] Bluetooth: hci3: command tx timeout [ 78.472775] Bluetooth: hci2: command tx timeout [ 78.472799] Bluetooth: hci4: command tx timeout [ 78.537148] Bluetooth: hci7: command tx timeout [ 78.537762] Bluetooth: hci5: command tx timeout [ 78.538070] Bluetooth: hci6: command tx timeout [ 80.393212] Bluetooth: hci1: command tx timeout [ 80.393227] Bluetooth: hci0: command tx timeout [ 80.520754] Bluetooth: hci4: command tx timeout [ 80.521763] Bluetooth: hci3: command tx timeout [ 80.522157] Bluetooth: hci2: command tx timeout [ 80.584729] Bluetooth: hci5: command tx timeout [ 80.584748] Bluetooth: hci7: command tx timeout [ 80.585819] Bluetooth: hci6: command tx timeout VM DIAGNOSIS: 18:44:59 Registers: info registers vcpu 0 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff8293dc70 RDI=ffffffff889747c0 RBP=ffffffff88974780 RSP=ffff88801648f620 R8 =00000000ffffffff R9 =ffffed1002c91eb5 R10=0000000000000000 R11=000000003a555043 R12=0000000000000076 R13=ffffffff889747d0 R14=ffffffff88974780 R15=ffffffff88974a40 RIP=ffffffff8293dcc5 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e538f000 00000000 00000000 LDT=0000 fffffe5000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f2a3f448070 CR3=000000000db70000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f2a3f50b7c000007f2a3f50b7c8 XMM02=00007f2a3f50b7e000007f2a3f50b7c0 XMM03=00007f2a3f50b7c800007f2a3f50b7c0 XMM04=ffffffffffffffffffffffffffffff00 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=00007ffec28ad200 RBX=0000000000000000 RCX=00007ffec28ad210 RDX=0000000000000010 RSI=00007ffec28ad340 RDI=00007ffec28ad210 RBP=0000000000000001 RSP=00007ffec28ad0a8 R8 =0000000000000000 R9 =0000000000000010 R10=0000000000000002 R11=0000000000656434 R12=00007ffec28ad340 R13=00007ffec28ad360 R14=0000000000000000 R15=00007ffec28ad210 RIP=00007f047d5eea50 RFL=00000202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA] SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f047ccc1900 00000000 00000000 GS =0000 0000000000000000 00000000 00000000 LDT=0000 fffffe6d00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f047c0e75d0 CR3=000000000e336000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d XMM01=0000000000000000ff00000000000000 XMM02=ffffffffffffffffffffffffffffffff XMM03=7461203220657a697320666f20646165 XMM04=8ee119785f53e3900000000000130238 XMM05=d3fdd5f48436fbd700000000000aead0 XMM06=87f3d72afda7b70b00000000000ae988 XMM07=00000000000000000000000000000000 XMM08=44495f474f4c5359530069253d595449 XMM09=00000000000000000000000000000000 XMM10=20200000000020202020202020200000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000