Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:37062' (ECDSA) to the list of known hosts. 2025/11/14 12:19:22 fuzzer started 2025/11/14 12:19:23 dialing manager at localhost:37161 syzkaller login: [ 51.070580] cgroup: Unknown subsys name 'net' [ 51.142548] cgroup: Unknown subsys name 'cpuset' [ 51.156438] cgroup: Unknown subsys name 'rlimit' 2025/11/14 12:19:34 syscalls: 203 2025/11/14 12:19:34 code coverage: enabled 2025/11/14 12:19:34 comparison tracing: enabled 2025/11/14 12:19:34 extra coverage: enabled 2025/11/14 12:19:34 setuid sandbox: enabled 2025/11/14 12:19:34 namespace sandbox: enabled 2025/11/14 12:19:34 Android sandbox: enabled 2025/11/14 12:19:34 fault injection: enabled 2025/11/14 12:19:34 leak checking: enabled 2025/11/14 12:19:34 net packet injection: enabled 2025/11/14 12:19:34 net device setup: enabled 2025/11/14 12:19:34 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/11/14 12:19:34 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/11/14 12:19:34 USB emulation: enabled 2025/11/14 12:19:34 hci packet injection: enabled 2025/11/14 12:19:34 wifi device emulation: enabled 2025/11/14 12:19:34 802.15.4 emulation: enabled 2025/11/14 12:19:34 fetching corpus: 0, signal 0/0 (executing program) 2025/11/14 12:19:35 starting 8 fuzzer processes 12:19:35 executing program 0: syz_open_dev$rtc(&(0x7f0000000000), 0x81, 0x4000) syz_open_dev$rtc(&(0x7f0000000040), 0x9, 0x801) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) write$tun(r0, &(0x7f00000000c0)={@val={0x0, 0x8864}, @void, @x25={0x2, 0x5, 0xfd, "207c3a68a08c2de13c888cc6386d17fbd38a55a742440ef134bd898f8ad56ae1902141bdbd4c3261a086d47a8df5a9539322b0b3f7e6cbe817443c8f7bb9e296d753cf1a9c6c3e1e8c65556e347156ebf45b69cf632e343592985071bd3dae4b1d2a89a4a595368cce5c2feb91e39f336c0cf25f21e5d51df66748ce22361785cae34d0b24c81949986f2d495ba8bdee62129dbd1eb93184b95663a6a1e65b2bc8c5a8dfafab0ed2d26ac056121f48d393"}}, 0xb8) r1 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000180)=@alg, &(0x7f0000000200)=0x80) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x40, 0x0, 0x10, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x3, 0x46}}}}, [@NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4f}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000840}, 0x20000000) socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) getsockopt$inet6_udp_int(r3, 0x11, 0xa, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7f, &(0x7f0000000500)={{0x12, 0x1, 0x50, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6d, 0x2, 0x1, 0x3, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "fb790b445a"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x1c4, 0x5, 0x3f}, {0x6, 0x24, 0x1a, 0x0, 0x25}, [@dmm={0x7, 0x24, 0x14, 0x2, 0x2}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0xaa}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x95, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x8, 0xff, 0x97}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x0, 0x61, 0x38, 0x4, 0x8, 0x2}, 0x19, &(0x7f00000005c0)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x80, "63073fb303650739b5742f6de904c3e1"}]}, 0x1, [{0x90, &(0x7f0000000600)=@string={0x90, 0x3, "efe67aca9f9b81f83f7caac0198cdf65ce6e54446b11a3a900e972309cc96dc0d400760c3415d1a0e2bc99458a3afa629d290694fd4d15a807de99f0d47513be0039fb62733c60c0946d4540a59fb6efbfc66a03de7f28abb52f1557fed09eb0503ad4c4195e8d0da95c2139aa1073120a18d081f88cb86a57ed860621539fac50f0db90a86f42f24ff51d0eabaf"}}]}) syz_usb_ep_read(r4, 0x2, 0xe0, &(0x7f0000000700)=""/224) ioctl$NS_GET_USERNS(r3, 0xb701, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000800)) r5 = ioctl$TUNGETDEVNETNS(r3, 0x54e3, 0x0) ioctl$NS_GET_NSTYPE(r5, 0xb703, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000900), 0x284c03, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000009c0)={'syztnl1\x00', &(0x7f0000000940)={'syztnl0\x00', 0x0, 0x40, 0x700, 0x7fffffff, 0x4, {{0x9, 0x4, 0x3, 0x3, 0x24, 0x65, 0x0, 0x9, 0x4, 0x0, @broadcast, @broadcast, {[@noop, @rr={0x7, 0xf, 0xfb, [@rand_addr=0x64010101, @remote, @local]}]}}}}}) 12:19:35 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)) prctl$PR_GET_FPEMU(0x9, &(0x7f00000000c0)) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={0x0, @isdn={0x22, 0x20, 0x2, 0x6}, @qipcrtr={0x2a, 0x3}, @vsock={0x28, 0x0, 0x2711, @local}, 0x23fe, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000100)='veth0_to_bridge\x00', 0x10000, 0x5, 0x81}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000200)=0x7fffffff) sendmsg$sock(0xffffffffffffffff, &(0x7f0000002500)={&(0x7f0000000240)=@rc={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xcc}, 0x80, &(0x7f0000002440)=[{&(0x7f00000002c0)="d9dd31efc8ea31c910f2f09f6d45095046a34343030058e2d09e7797584f9b2cacfc4b1ea021826635a9506653e57cf55bd44b3b892df76ff430c5e5f921934d11abd969e89c47739a536f09b5cf77e2f39c9f49eaeb98bddf35b20e65d2738b5d7e1ee6b71e315a360031f736362e4b015ad41f399aab188234dbb75f05025bf0bb26f7221afb49356ec460", 0x8c}, {&(0x7f0000000380)="877aa073f802fae257dca0f381dd0a6fbc98ea3cb664e49ca7fe3a6e0653a6028d6eb170c9c89faae476c08634636e4219e92eb021748f8e912e64fa27eee76dc504132d02c88c5f1291463dafcb7d567a6d5f713994c122c9a89ddfb4b1bfc90d136d0d83ab30c61a4a49abd2a4184f1ed71fed3db1516f4db54544756a104666e3c54fb428d269b9f0d85f8df6b1bbb3c903e7b2975f99edaea21bdf3ec4dd1cbb9a19574ea38b4a084652057de41ee6650f51bac055c95ed6509818214036ae6be88d288eea88e941d8063a75f69ff219b01cbf0ffe3430ac9b854d5149c13d830599d16e01ff1693a5ebcc7d06fae3d29f336121bd32581159a19ea5be6d25dd2b0841523193d53d304b3338dbaa51501cdd6f3fecc7f3ef58db7123386af3ca714c42249f14819c77e097f0b742d65064104b3ea2ebf9038ccbfa03a09edc1ff4381b918c5aa03a052a7837b9a32478021537fe3dcdb58b2c1cf0bcfb5e21cd4a8d106fe0a6f4c5b48b6b0cb76791cb82227c0a59fdd6c657002ab11125b742e00720c821ad8f90a25514fa764640834ccdb90a1f413410b73e69dc258ec45d38802cfb7f80f92f1b217c08e834964d5471d5e0daf2b832bbff5b51582f1b8966e8f4b1cbbad0489406b7ae24cc0f8c9dd85612bfb499db327773807e47e5965df320bf67e005ce2433de9cec766d39cf233af3f06834c0e40c3fb2fafb56b71edabd8f192d2689d73e9ac0390b7fd1b694f0dd9aa42e29ad390002b0be9eedef66c85bd7a9a629a266414397c3c872e958036156f94b82cd6f16cd1f034431248349e5e9bb6d2edf432a0005fb8f9845ec5a358dd5900eff664decf2401ec4ebfa1732e194aa567faef9fb2bb8f70c0901f1f40b87a42f33bbde110e44d5423b4cea1cb53d74974c8c6499f42a0fe6f2027cb057b2dcf48aca43fc673c4b54b04f95456931d37b4e670ae632a0fb24ce7114ee1e4928970fcfd33cd2f548045bd81c05a6f43d02dd8ea474a177073b77a49a4520186f168c0a70c8f48bb0d5db5200287c79a4713ac06e243b3211e97d108b7f58558fa7e90371a37a083208532672dd7e3b717a13e98924d1e0616509d99b125877047622ef60daf6e777675fde22db6684e6062fe8aff7a1a2d74f0aae76c790075542afefb78a04d447ce0cbac605606c8df06e9aed1cc802d6e36586a5071742ccc6d07ee9e96e2bd9baa0863f8bc96213c059329f299744903aa25b3a03f9d5840231f0d131661f8268584c2691098d241c0fcbab9654e5953953868b8d07af410162478f0538d049041f0d93090af8ede21f0301fc9f8bb44d69e84dd2131ebd00973f230545546d46b1dfe1f594130edd227bdc8aa363c0cb26d8e276037cbb9502083fb59958b9e843986cbbf3b0a9126ba104e60e350efda2955c206ab1895cb0a49c94b3008f4969aa0c0a005184aac8660c5ad81156867a28064dcf376d2c7a6e3be254ec6ac74efd8a66cc28bf997dd99d84a70674143fb5f1e28fff5f187ea3682e3e873935432b6ddda795d579768d8ca301720d16f246aeb66d952d71fcae4de8181ebaf4be2215be343dcca3056a3e22f4edfd8f4e9064da30f78bc1f95a354fe7363280a16bb711ada0fe2668723369f52f916bc15cad7c8b5410f28b2698ca9a9917babd9c6c744874de20458d489500c7688ff0794320df9a07ec486cf0f43dbd50a048811a2e67bd743cae913a4fbe3c607748a3d4ec7c39424298018cebcf78a6fc1711f498b47813082167a133dfa83faceabf48c46ed0a534ddae9d6c23598abf4c37dbc5523e2cd7c3ba8acf35af245dba7e982a5329e994799ba2de4f2015b25f972eac410d394bba1ee3dc595c28e16be943ab7f3c3f4ca3eda1920f58db4f6640de6d5b34719ad8edc8a3604f71b745ceaac633373cbf7de83006ac337b603d65232cf2de10405b86d31ec87984c3ce5a356d3639b4ef926545340a6b555c6e716bca5e16febba9a851d7f2bf853c2f1732471802e3ad1620fd383d3cfd9d2687610ee918457e8c794360cd707c7c4062a483b7143bae9e2e76b6c1d98208162f050d83f25a611fe7958838cef8f3fc82851303ecbfa62c80c2a16e40a5b9c36e34dd7aa055510d4498e1d164b2f983a29efc48f57a7650b16cda0329ad5eba7dc852bc5cb2c437deab3df8d7a7f4a79909eee40f3fc316e6c0cf24a3f5d53d9c732d3d61060c0f5626454210eb3b8a420d3229fda23c53fad37c3413446b79d8a4375c284eabeda7d4b0c81e557de4c361491ee590213e75827ba4f099da6152d8aa18b8e105268a42081802baf58943b2f3635f0b8baf9669270b3341d2c058c10196f6d231c830eaec3b7e8095115f53fbc9be2f7d5e11d7905f2cf4c8679cf5d9dcee7c593aa2c3ffab4b53f0e4d43ecfa4168a422cda615b7f87653b9f5621d9c184b84119dc516aa4be69d1997a0935050fb354bb54377dbe6a4e9a5eb49332b40213281860e9b8d000ab661571ebbf328a93e178a50f327ae81f7096ef17e7712615bf0398466da16cb89dd8fe9ea8edc448fa3128d3e8fb4878ef75c2c871ac584bed5451357e0c841a3e781189ef6680a39f0e9c41f6bee80d034c7fdac1ab3d06c3a4f52db32574c02e2ac29d1307015c2b5a8b14f70a52dda1b5bf88b3874bbd53dbc944b82ac84e5459fa7c2bd3014c5ba1c86892292db4198cb8f0f4009dabc6a99272c2833315acbb0403403dd642751f6ac2f94417cde7d5f0cdaf2f3a58076b27b537e0d0e33a961263291019aefa416ba8703226ab9055070030adb556e6c8fff82ad5034a3396d4c4581276734ba65e115bd6f91ad7420544684c04ca5dfd0c2c2a3c44a77db290fbac3597af2948169927f5ce9ed1ed7680d4d877091f5abb06dda3f7655fd33b73cefcadd5b4ee794f07472475cecddd0c219a482567e2c7b10cb6f43c7472fad6cc5d6cff786e17f2a4beb13edeacadee0390bbd2b0e4a67d125a71e290a5eb7c22b725b3567410cf31dcd2d37bacf314596fb9c6940a05c80ccfb146853bbfae6cc2c60ed4399c99695b209e8bf0cc27ba8dda0d5bb1c70eaba315693f5b9aea19f1a2d9ffc07d0fa7d6c89e8f85603b60698c81301df31b8b179995b2aa3639ec95bf5c977deea3592879ab448c6fbd7be1f21ed4848474c172ed1b35d307fa6490b940067c3227035e16d60b8c57d65a4ee4a83c7b904a4dd9578e2c3796010e267b81296ed49c8b56310c0f1aa76ad89bb2f0eacb0c15447248be82a62c4525ea63b936fabb178664093304b6f4143453b4eeee903fe4f3c6b0f50f48d71211304e9de0bc1a446f76058e9a28052d8ace709418d958cfc2a46a17534f976d208e239c4a56f4d8f7fb79e1787fbcd2ed49cce5b7eebb7e719d9470ab794a9b021eb8b4f8bdddeec45547a1bc4703305ac50eb463256f1ba5ee755e179c79bb8d3b30791bf7f3bdcd93b018b5be365c9656f7657df5ed30341c96f6c95122744261c6b7dcbb31eb25ddf53b4a7232eac03752133860c2a6ce2176cd043e099b917c2e4dbf9ced179eee2706a8edc4fbfa023b7fea98eff4ab3673c3920f90981331915ac7a73e8a8f64a73e641c054630487f83ed51230c7c5c396ba3217ed17bf249ac3256747c486a1ed81389a75cf3da41498236f2e6ec8aae3dc9d97a4c27abc600944ca29bbbede08838148d3f5f15fbab9aede94481b41e83402b24b263217e9add2e727fc491433c05cad06c45989743f7065dd17cef60d9b4b4f28bcf9a1e80d4313dc3c69613633d88866c364a431f96c06ee9a5b891bc13b71ed08ec7c487237a1813da562c530bc48b7d4c480de15ec27505183e7641bea13a5813bc0a4dda8ec51f0d07ef11a2bd667ce3fb285bc1e2843ebad6247b7609209fac8746264dd4f92b01eec002bdd065c4286b8a8aff87ab98bab457666242d8dded9cdc3b3f67a797ca73d50348f34af0019fb3c177bbc2c9a229f959e99b55f1dbf0a51600dcf47c34f5077df812def9b26d111d30b7ca35ef358653ac1b840cedac1b47c6b45df6440360bac921afd59b0c53037b2597f074137b0cbfcf159b65da97251a6f89759ab2c02d9ee896fd4d15126866e944b7f10d4fc5e23110f557a952ce3db31de4358522658fa9c827de83880c1114163189778b22ac149b989d85e724dcb104de60aa462ce519e5a89fff5bdc607b4adbb8446d7fa3a331ab0b70e55738529b6d019220efc07a7428a2dfa1c23c950d37bda1779a8bed59699a9cb021189fd048930277e1c37a397b64bb3caa4cbcef9f19774dd79e378cf3ff59e5a681f245782c6bcc0d25989e6e34e40259302d98dcb361699f556a678d52c7578f7da9a7e7a7976444cc1c8516292d03dd77c382c29eabc30cbc01ad7075e0bbd0ba1ece6824173c2f4171167e0e292c05e0b6a9082db8c6f3ca5ab9c2062c661baabaaf27541c51e028c41546e4e45e85763d7b06d1d31e644f1cb911f097c145bfda658c2210e6634f8a8e04d098f2d50430990a6ee4c2ec3e0af6efd2a5831d58b4afd11e6affc4363953faae98318211c6f586927e2e875709cb48c91d99380bd3fb0f6cfb81734a740f7744a3b3dc5d9623175c616cd5a3b30643c2c06076f37a59d3cdd005b52312598fb4ddbc47e18789760025be8a98e14ac84229425f2564d0c9f545ca599c29b4d93b0c3b4468f7f85eb7a2ac8baf5ff1b12a3f32dde8f54ca5e4a2730c5cbce64b897a22197202e762becc13da4decbb329d705451b271ee84b15fad81dc22c5d6db006abb5866b6891d7c7d9e71194e041bea646b6d884d747c02bb0ee6144aba62b9edded76d8452504e763b7b7eb6f13789fb5e616abab0fcd95116772e156c7f01b5f2fd891055c2a963937ed3967bb0ebe0b98a6126dd0dcf9e8c0deddf91fc26a8ff43f0a424e49a76bf934cd4b9d545be4bf19b3b903853accc6fed07195ddc86ff224f8aed1dbbc163a45a6a66209671f18f7b7a599c7fc6fc7e6bdbe4c74bcc728a09abe24a59f2b1c9bfaaf6149b0198f8e665e9214751a4a47d89eac79e06a3db703f880e63c56efcced5c049216473960364f9f0d8926d0623879391cc016f72f52c09475c3dfff9b52580e7399b3bb9434a7b6435add654876820edda1aa00da11008fbff364cb86915c52fc1a6ecad9ddee3f4e98aa337108883e81d449499066500d6e6a111784ea29d82ba496b877e542be9b49242570094e01f3b667222e42d595bbfe50e17259e8b4d3bd26f10cbf2346cfed8a5049552a4a4ddf1c06f336a5496d3c268e6c6b0e6be624153baf317f940367a9f84a993b89e33cb34896ca20c6457b8fbe828fff7b01e2145da88dcadfd031e10ee335e3aff136b75222985e93d5f6b0506745bae8a4b6925273adbca4c4a1d29ea1dba588e451e135eee6cf8684fcea9ad6fc5530860d71177d67fab848fd610e20b451964fdfec20ab91ac05b5dad35200c664a54f243f5e9ccc9f9d94c1161115244d95da3807dc242b94ba023c046b79f4fab4a30393f05dd6b054dc658d3766d4251d26a050ee3a6fb9685a075390329c2b3c31bfa2c8ae5ab49a349f2fecd5f9a2b18a4d3bb6d6fe012f8fd8fe02f12323150748c18e31068deb80941c130ddfb7a8bb7f62ad5c7550fb1ea9d49be53996d8f09485e49bca8e65752e2a97d3180139fab4118c03e456747b671f51d3b9bca4199922d9f431d9ee5b56d2f29fe947ef865111ecfeadd9e5661969de484af0f26dfccf5d7490792b8dceb", 0x1000}, {&(0x7f0000001380)="0657d5324aac15cc5ec064c309b176bed7909e4c910fae9a7ea54b141b3e97b589232f8f60f96102c39c6745f37b6a4d7266afd5ef8e3d8412b74021592ca1fcf12d952064cdff95af1353ccfedb21bb4859755f3c7963272bda93f2c764c44189164a50d314b044667a68133454a14c2e8b7336de9c11489fec6f180d7b5c8bbd537fc58a6d22b6eef3a5e149ecb3f3df8265b4df8cfeb8ea4548a5d3e4679733200b6b1499baf31863deee56f92b46a32a3b32a4a4c8b4aa49f93b8dd55a47d6828bd39de164aebd7eccf9635af820ce03cde917c897146a2f1cdaf8c8f6b11bba05a80bb411cc9c785ecac38554c789e1bacbd522eac21f499d2e069b32362954ec17a03c29419d9d667b45d23ea3ccc4ba1686059f2dc59ef6de628e5a097675c369811a7c50a6e2fc030f046697ad394251d53a813dafc1a08655e1aec98771791b4b11b7c26d5017ab2760a1fdaa7b78ff468c08da5ffb5d70f5e8f8db14d79f93729b67cf1f9429629c75d48a95917721614aeb2ff0ea0a3f231760e765928871f8e8552c09fb491c4d2e87c3d51145c2ba743aebb0c840b7435b3ef8cc3d26e631a2ceb7048b6809ec8b83b7437d5045ab1a7726f8662a36c2cc676d9775944140884ac44b30ea6e7490fe1cfa999e860027c710f861c8bff731b9924ce7a7a0a484387727622cacba28db28e36c2e92c1eec57aab54829f8cf4634f411599b0f5abe940d1d0333b78c5eecca3b85d3576eaf8d128f4ef4824c303bfb66b70fb2f4643e5950d5568d380c9f6d3b80e5696205e99ef8c9769333802fb16a69f5370a4245fdc052237233a665ed9ae514610235abe55262c03241a46a7557faec3ab5b58669ac3bf67216ba6cf6bb22431a32135e5746ba845a0342b5dadc520d71bc24cafcc582ffdba8e64d34d156878ff366d68e4491ca348ee2b79f06b31aa90ba09e9ff03943e9264178752429d625f94c9fa92977e306eb0cd0ccd8dcd235a5b5edda161795f8b631895f90bab73dd52d1eab0ba48f8ead11bbc6f795f28f423deb6049d4211abaa249915b19b872da23c23bd7007009022bf0f48efd8432b7be2ddde8943d899b73b06797d473e55bd5f938acb0bc110d20cc54e2f8cfb17da98b650f4ed53a31de3d2c2835487c4c75bad14b2e84e30c931e5b1d960190aa8edfb124e565bef87008cddd07174755b6644a8793428d256708fb2c6c6f2823964f85cbca172d562bd126c0f9634c84b891e0591a122f57c751d452f1ca54b1f72dcc7716fb74907cbd897ef17f5119d00fb706dde85df6957ec45c730b489b7f8dbb9fbf44403e9ecd5f4696a7837989468e55d748a278b3f2b5ff1d50ffec664e98ebbf91ba6423a629e44ae2f6e468b4fc7aba19d77ec4b7e27817ca45b337fdae5fad795277194f1cdb53c199c2e0f8f7e4455856ceaa3f1d63b97cc29fc5a41ae2679f48c13d9038c9934835da3a2db4408c005a50025d37b0ebf88c7a081abc4743a80520fee065fecb58d23dfeb901718b4e5845db02fb96a24f90cfc3e820f405ea2760cf21551df6b2108cf22985095eee35052d742a2778167205f9b3814dcb4acedc12214480ffb3cdc7b0b8dec4c04c635d922737edc0bc67a0c301e2b5af975a2bf7348d65385b2c6aab962685fdba3f04c02e27e3643879a36fcdc0192a401bf46c7319b970d41d7e4764e01e6fe195e4a914155a32d16d38fff2f2ca4c596f5ce5babdd8323783133acd9553700994fd1a0e827bf1ccaf1baf558a7f7a95b2bdbc0989490f97bdac89c6323029e1f8452eb855dff60cdd3a5170e921283e7e98471f533749df761f3f6ecd82d56e7a45920a6905abc8fdfbc80433dbe674c69be961ede27819ddb988b32650c6d24516ecb5e80be15a9b00195ef2e5a2a5f90a9f6c5e155f2519c4920fcf21741eec5351b3b042a23979debad0022936e879b8b5951bfeab6d6247ff32503209ec57ff9867143d50b131774315b82daa0a8e318ace5f7d364cf8dd5b944d013a82a3fd4a42422376d905bb3a5cbb0bebbca2af0d9e0b2f0abb8e3017ba55636ba76582fd679f76189907b3cdcd20aa258d47c1b5cfe51ecd7f6615dad04c1cdc7bb136aeba0daf9296e98a310734ac5ee4aa01ba937d83eb42e67f1b665c5867c89c583c80560c5448332d3a3565f1847a1097128dfefc7779766680efc6c079daa7329afd0e709839cbec5dd85a8d248fc2adfbcbeeb3e892ad56b0c48eede5bde39b43cbea05acbddd05a73702d3da29496e65f9814bcd8b1d8c090133483e09749339acd0079211c4df78ace226c0bcd019e38a8d439ae813a3fc6f108e3991388c05ed4607f727e76a62bb79a3ea0f0d46d00e65df9622ef20205497436c02405934866501bcd70cccc58c9852eb61e3731e9f6038d5876607d4cf5609ea20c1d02327b583357cb187e398f810be2a8387a441e89f39d650b86c9c91f0f688ead9e8fdbda5cb35202917bd95fba43697a86b3c2f460acef19510578d32568df96a3fd286e1bc64f6563ceb8f869873bcf8cb4639c6e061b67a821a43c5e31a5ec9bb27e831cde4b2765983aa1319d9378ced48d540a82b5d06a9e32bca96c98cdcac7e47d08097be5cbc3b33f983987baf94dd14e9ad6a6a56dbe9673cb5d27e7816bbc977589ac57efcf2326b76bc91bba29ce419e70821044e363fc7953b0272245c90391c98d3ebb8303b0702f02d11fde3cfbe11c4d1601d991c40762f25e9fcc80a472a3133087f234a49e9550cefc582abb436d69b9ecc84ae0c71d7b54536dee202725f6610d7e6e89ce263d977653f2650f0a7c4b0ba43db01fd061a2bfeb87f49406b5da3de24ba4bfb74ba75a8486ae3f2c4028bcd64ced08e4823e1faad5f961f008a3be1cb6378ff092d07084af1819d4a950e00824eeb3e0df6ba506acc526fe8257437b2c479532aec14999036a5a133fa8d56a590868edb0fd646faf867e791a59e0dee9f7abf30db37701a0233236706c9c308839bb21ff0b83ffad96931d087949c31eafbb6d67980f615b840f0cf01466ec3b2ac362dff3ca8b10d7c53a2e48edca8c3544757e8fe3e131088cbc9ef84a0472e10b4f68b60edd7e97c7bfeda8897206ce669cf8d9be38e03d7d247bd3c19b26b78436de8468c958a3dd5fbb6044bbebb7ec941f198dfb4127cea9603627ff875122e2affdf64bb372d88d802376c23e7b5110a5cfa2a5498056c3f9b8e086568164e4bcdfefc0d5a27bb0f90c80855c7ba3271bb42715ae6351d75085efb47d54d99b0e9503ebdde370e5ec288a708a2fd15b185aafc4909f628c0a09200d9a3baf23e04c502474601dad15d124aeca144cd26736b126630f336e926b5f58b10f5f8b8ab1b09f70bbe9819bd33a5429f1c1f7f08cc0e69b1b9dae84b19aee007ce16059024b8de478625a3455ada08d6dc756dbadc858e01b597a0a98e6208735a2dc434857c75e391107a16abbfd430a1b93096104df2c186d6d645b6620e6d12b8e837a457bd055c7297c6ba2e4c2de234e5299ad370bf7145f6fff44a7b7640a9dbc415f56fed3f05ce71cb92baff78125b4cedc3347958e25a482fc088746de436f449c224abc236af381aa142bf417b4b2b937197b180fe56ae5d5cb6623981e7b6f211536d58948385e045e3d4c7b173384e8f551ecedec30f7ccc720aaff33fdd74537b825a6186747eb6cb159f2fbcb3ad1d7d3b48c5ed5d1a8709bd2f9ce1087e0871fc4003b115188159040fff25bfa3560b8898f93d27cdc5f43dcd1a16296936cacc21a1f06c82dc63596ae8f21a29c4ef83f8ba2020ac007a9f65a78543f1d77de5e9574d4ea77cf183329af90ba4af7eb916f81743d9b4437ff2b1b9e8c61b176bf3676e6ae1e84d0a13e922693dba000df62b73ee257de0f854102411d25be0fd13142a85dcad0dcfcd9882d9f22905e8b8f8f5531202b0dbb46e9dcc2ab5bca0e547bcd2df503d6ede3d71c2d7c7d60c7e09f3eb41dd1ccaf2bf6381b8390bd5877cb45aea1c08253b8b838096a633d057ee97e605e8baf602f2a1529d09c6729796e10a7ba0b4371baa403a07d8eb80fe8a0d047ce41ed153dafdbbafaa6794f64856b555704eb3ffa1582389d8eeb719c51c10005066a69db0e875ee61244296f7bbc5cec668e1437eafb125a230b0e4e242827d6c702e5b98fdc71c610af16eca17427b88a1bf5c8c2ae0665808712cc27df334328de78beb460405abab3d5130b54af92c435f9f71ca75e73fccd136dbb27819c1f00b20298957120c018623a970ceb83e54bd7dc1cb0097506d9684c3bdb8e7d51067fd91dd1846781c96f9330f9112e6436294e504be0a2d874387cb9d6344edcd4027c675161a84dd227f15d0ae099dfb0f0fd7d90e6528e87d1b8e7ca8a5559248df074f9976069362e626505388b0e823185e3f8f15d1731f64f1ef10caf415122b529e99fc2c84adb79db217b5cf93605caf06812d476bf8934cf6b4020bd28845e7684a44ed46474b9d4afc55e4352e5810f93705437ff3216a07388240d108e4835c241491348b227b56b14938721f4e184c9ae489ac43b74c1721c97545d14c3d8498f8d8545874ede796748d369de6b1aaf96a113444268e688300ed5a0079a5ab23aca1fbfe83374835448d2b5af42233a31c01900a3053da1ccf32cdba64f315bce8153646fdc2026525e9685302e69d81b7c521339f0076e945566636144edddac911897aaae6367f5b91f7d1394a2fa2d02a82c35de2f3f61bfa864f1f23e9ab5a4615fb9146044955b3255fe161d141c28bef5c5beb797256398cac91a61a5a44d282685721c4be60f862f34f9d257661c22902b7bb88f3e4d28a861fb030beba392cf37547a7d0c01a310e03c967fee078bd9e35d38350e510ea3820f9638630cbc6179a026482e93687fcb334bd540d001223052f7fc3a55819d5fa4bc3fc455c2ea29c1df17ca21839357294610e71d78f7e2d910df7f6eb33d45ecf37995a8e53db3be244275979dead8f2966c0d5ed62e0d0c5c9b5a1c4ab86f3f1f9501416f2fec4479645a570e21a469fe37c14e08663196bc536a7b3d0e43e48faa32d63027274545b701588b5f5b7eeb4b51a95f2b0565d5e50415bad17fab2a141bee1a0b66cdeb1bc3470b7f410da3480fbc7ecaabf4f0efc2e661b12f1be7a27b9ef12e88f6b8c9c6899ac1191a6641487cc160a33f49519ac3e488ab9c4a3400b3ef4a81888598281dfd18a6df8be95e7a2b63881e1f04d36625300155362edf583dba3b496270c01cd33f28650788967b3db3b0979232f76fe58a34f51dea98081add9c0c737359338b86674f0dcf143b144b1ef82c2038884908f1cdadea5ebb82edb0b688d63ec2c198bf548063cdcda817535332ad6782a72c320db4d8b620a68856c278702ee13d3f99f308cdde9b06aba4aeb795fbaeb423e57db38dc4479490b50f10249c3ee41c795e94254b461a72900dcd76c6d6f992fab53026167168475e79e92a2dd7ca6913a3e65bd434eebe11a36eb80eef23b1cf726971c96321eda7cc1b434e586b92e098f3031fceb12b1f90654c1e2cedfc0606f713d260136b0e06a73f0ab940f81d4e967836a8e02528b1c8e758d182ef0be479418ebfd9e477e963b45f06bb23461e6953569e4d0378f3e088d459e69d5a890aacd5bea1c325cde379427e9f1a83064c8406bb994658549bb2c081dced816b5bf973a60a4ca099753921db992a44884c9cf2ea94654ae9eb97274c6543a7558de3708a2e21", 0x1000}, {&(0x7f0000002380)="6041cf01735f7de3f5a8b742d7da4dbfb2c5b07e9de45533cd22a0852f6c84c582b77e420b4c2c8d9aaa3d3e7669c5ef8f924f7c2a096dd72ace3183cd31b54f420e63c1d18591213d84ec9f7654bb154347788f39a93238e79c4464da038a07c90f1d11c71bcda92ac0d2ca5284631f86be8c67af766f4326d94ff6d870654866a5a98c487af15148bd328c19d1e4ebab54c48ac0a44762b16650", 0x9b}], 0x4, &(0x7f0000002480)=[@mark={{0x14, 0x1, 0x24, 0x8}}, @txtime={{0x18, 0x1, 0x3d, 0xff}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}, @mark={{0x14, 0x1, 0x24, 0x52ee}}], 0x78}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getpeername(r1, &(0x7f0000002540)=@ethernet={0x0, @remote}, &(0x7f00000025c0)=0x80) prctl$PR_GET_FPEMU(0x9, &(0x7f0000002600)) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000002640)=0x2, 0x4) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000002680)) ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0) pipe2(&(0x7f00000026c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) timerfd_gettime(r3, &(0x7f0000002700)) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002740), r3) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000002780)) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f00000027c0)) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000002ac0)={&(0x7f0000002800)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a00)={0x74, r5, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x9a0}, @ETHTOOL_A_CHANNELS_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x4008881) 12:19:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'gretap0\x00', 0x0, 0x20, 0x40, 0x3610, 0x1ff, {{0x29, 0x4, 0x0, 0x4, 0xa4, 0x66, 0x0, 0x6, 0x4, 0x0, @private=0xa010101, @rand_addr=0x64010102, {[@cipso={0x86, 0x19, 0x1, [{0x0, 0x10, "c6b9b2c2f525afa75210ba528a45"}, {0x2, 0x3, 'u'}]}, @ssrr={0x89, 0x13, 0x43, [@rand_addr=0x1ff, @local, @rand_addr=0x64010101, @local]}, @timestamp={0x44, 0x10, 0xbb, 0x0, 0x9, [0x8, 0x2, 0xffff]}, @lsrr={0x83, 0x1b, 0x84, [@private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, @private=0xa010101, @broadcast, @broadcast]}, @ssrr={0x89, 0x13, 0x51, [@broadcast, @rand_addr=0x64010100, @empty, @local]}, @noop, @timestamp_addr={0x44, 0x24, 0x4d, 0x1, 0x6, [{@dev={0xac, 0x14, 0x14, 0x2b}, 0x6}, {@remote, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@remote, 0x227}]}]}}}}}) r2 = syz_open_procfs$userns(0x0, &(0x7f0000000180)) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x9, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010101}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4881) r3 = getuid() ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f00000002c0)={'sit0\x00', r1, 0x2f, 0x1, 0x9, 0xfff, 0xa, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', 0x80, 0x7800, 0x80000001, 0x5}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000380)=@allocspi={0x178, 0x16, 0x200, 0x70bd2a, 0x25dfdbfd, {{{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0xa75, 0x4e20, 0x7, 0xa, 0xa0, 0x0, 0x2c, r1, r3}, {@in6=@mcast2, 0x4d5, 0x6c}, @in=@empty, {0x1, 0x6, 0x7ff, 0x8000, 0x7f, 0x9d0, 0x1f, 0x7}, {0x7d, 0xfffffffffffff800, 0x4, 0xfff}, {0x6, 0xfffffff9, 0x1000}, 0x70bd2d, 0x3501, 0x2, 0x80593510f4eac43b, 0x1}, 0x0, 0x10000000}, [@algo_crypt={0x6f, 0x2, {{'xchacha12-generic\x00'}, 0x138, "eccbe8048cc028333cd22fce6c62427ef604bafe36607daa77a3c14918644efcc04e784ac8f9da"}}, @XFRMA_IF_ID={0x8, 0x1f, r4}, @replay_thresh={0x8, 0xb, 0x2}]}, 0x178}, 0x1, 0x0, 0x0, 0x20040000}, 0x80) timerfd_gettime(0xffffffffffffffff, &(0x7f0000000580)) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x44, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8010}, 0x40010) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADD(r5, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, 0x0, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_DOMAIN={0xc, 0x1, '!\\--,}.\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast2}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x22000044}, 0x4000004) r6 = socket(0x1f, 0x5, 0x9) sendmsg$BATADV_CMD_GET_HARDIF(r6, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x24, 0x0, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xffff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xb6}]}, 0x24}, 0x1, 0x0, 0x0, 0x54801}, 0x8000) sendmsg$NLBL_MGMT_C_PROTOCOLS(r5, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xf}, @NLBL_MGMT_A_DOMAIN={0xc, 0x1, 'syztnl2\x00'}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r7 = getpid() sched_setattr(r7, &(0x7f0000000b00)={0x38, 0x6, 0x10, 0x1, 0xb1, 0x1, 0x7, 0x8, 0x4, 0x5e}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_LISTDEF(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x2c, r9, 0x20, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x3}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24004081) sendmsg$BATADV_CMD_GET_HARDIF(r6, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d00)={0x58, 0x0, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x20}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x40}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x200}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x4011}, 0x404c) 12:19:35 executing program 3: r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_TID={0xc}]}, 0x20}}, 0x2004c044) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, 0x0, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_VERSION={0x8}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008040}, 0x40005) getsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000240), &(0x7f0000000280)=0x4) pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$RTC_ALM_READ(r3, 0x80247008, &(0x7f0000000300)) openat$sr(0xffffffffffffff9c, &(0x7f0000000340), 0xe0200, 0x0) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000380), 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000000440)={'ip6tnl0\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x29, 0x3, 0x1, 0x7fffffff, 0x8, @remote, @mcast2, 0x8000, 0x8000, 0x5, 0x10001}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000480)={'batadv_slave_1\x00', 0x0}) r6 = socket(0x10, 0x1, 0x3f) getsockopt$inet6_udp_int(r6, 0x11, 0x67, &(0x7f00000004c0), &(0x7f0000000500)=0x4) r7 = openat$sr(0xffffffffffffff9c, &(0x7f0000000540), 0x2000, 0x0) openat$cgroup_devices(r7, &(0x7f0000000580)='devices.deny\x00', 0x2, 0x0) getsockname(r2, &(0x7f00000005c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000640)=0x80) sendmsg$nl_xfrm(r8, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)=@delpolicy={0x88, 0x14, 0x404, 0x70bd2d, 0x25dfdbfb, {{@in6=@empty, @in6=@private0, 0x4e23, 0x1, 0x4e22, 0x1, 0xa, 0x0, 0xa0, 0xc, r5}, 0x6e6bb7, 0x1}, [@offload={0xc, 0x1c, {0x0, 0x1}}, @replay_val={0x10, 0xa, {0x70bd29, 0x70bd25, 0x8}}, @extra_flags={0x8, 0x18, 0xffffffff}, @srcaddr={0x14, 0xd, @in6=@private2}]}, 0x88}, 0x1, 0x0, 0x0, 0x8804}, 0x4000040) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000880)={'syztnl2\x00', &(0x7f0000000800)={'syztnl1\x00', r5, 0x2f, 0x1f, 0x9, 0x0, 0x4d, @ipv4={'\x00', '\xff\xff', @local}, @mcast1, 0x1, 0x1, 0x1, 0x2}}) 12:19:35 executing program 4: r0 = getpgrp(0xffffffffffffffff) syz_open_procfs$userns(r0, &(0x7f0000000000)) r1 = getpgrp(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x200}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x401}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000050}, 0x2000c040) r3 = openat$sr(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) getsockopt$WPAN_WANTACK(r3, 0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000300), 0xc0000, 0x0) bind$802154_dgram(r4, &(0x7f0000000340)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0202}}}, 0x14) sched_setattr(r1, &(0x7f0000000380)={0x38, 0x5, 0x10000038, 0x0, 0x6, 0x100, 0x0, 0x85be, 0x6, 0x100}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r3) sendmsg$NLBL_MGMT_C_LISTDEF(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x1, '/dev/null\x00'}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x21}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private0}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x11}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x5) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTACK(r5, 0x0, 0x0, &(0x7f0000000540), 0x4) ioctl$HIDIOCGVERSION(r4, 0x80044801, &(0x7f0000000580)) set_mempolicy(0x4000, &(0x7f00000005c0)=0xfffffffffffff001, 0x5) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x458040}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x28, 0x0, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x10) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r6, &(0x7f0000000d00)={&(0x7f0000000b80)={0x24, @long={0x3, 0xffff, {0x4626aae5c66eabe5}}}, 0x14, &(0x7f0000000cc0)={&(0x7f0000000bc0)="27db161c32c7fd1334da711beedf9fd802f2d745196b1bb2247b157938cba8a3b0f772e74b456ad5cca57c3f472738024f17e4c7b39bc4971bb44b32bd74e9056b882fc9698c6bafde40c84fd69d6f83ccda8c7bd7c4758763e6e6085dde2a7f9b693f69eee8eef344ce9e46dd891496a47b875dfd249f444b4fea251896045438230e0b5c392dade365588548e65d6684c8e1f0e3de09db9960e233f57876055860b2d2d8e3c63a536049763d18144dc1a0742cae2f588fa18aa6b41bde7644cd53", 0xc2}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000080) timerfd_create(0x5, 0x800) 12:19:35 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x422000, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x2b, 'memory'}, {0x6, 'freezer'}, {0x2b, 'blkio'}, {0x2b, 'net_cls'}, {0x2d, 'devices'}, {0x2d, 'blkio'}, {0x2d, 'net_prio'}, {0x2d, 'net_cls'}, {0x2b, 'cpu'}]}, 0x49) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000008, 0x30, r0, 0xa7e07000) ioctl$HIDIOCGSTRING(r0, 0x81044804, &(0x7f00000000c0)={0xf7, "601d38a0c1c55b4074c7d640634934e82b3626c3ff4d4ed89ea4e851b59543e83af9e08e7e534cac127d48796601301ff9526971de4f76324fb73576757441105da315a01b289fd021ee1f76b6879eea9052add8aad5129c123fd9dcd7016a8999a909dab28c115b9154110144257068a8e6cced102ede22c42b7519f3f1abdeb3fe067e1146ad82d166d6f8c5afa64f20cf617deb41fc0cdf3e925bd8e3189232d234c3f67898d3e7e15a56fdcdc7d861eec47730e2872cb55e7285e7a955295730d102b99487822d2165dcfa1410859a74d50aa7dc82439c4bbdb1832c20a34fc6a581aa21d5e0ea34e302ff4517611c3c7f04db0bb6"}) write$cgroup_freezer_state(r0, &(0x7f00000001c0)='THAWED\x00', 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2400}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r0}, {0x8, 0x1, r1}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004844}, 0x48040) write$cgroup_freezer_state(r0, &(0x7f0000000380)='THAWED\x00', 0x7) inotify_rm_watch(r0, 0x0) setsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f00000003c0), 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000480)=@req={0x28, &(0x7f0000000440)={'syzkaller1\x00', @ifru_addrs=@isdn}}) syz_genetlink_get_family_id$gtp(&(0x7f00000004c0), r0) sendmsg$sock(r0, &(0x7f0000000800)={&(0x7f0000000500)=@l2={0x1f, 0x1, @none, 0xff19, 0x1}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000580)="e2659c4af969ce4862f5e7811ab6bd489437de2fb86ee581821543fda24ab096e63ddff5f9b50c79370a11566002c4ff481cefe39909e5a44c48b5b3c3f89f1d51628b15a6e239f72c1928968e071718ddb9f01131bbf0da883d5c", 0x5b}, {&(0x7f0000000600)="02f656c9cfb017c465432d2d17255e13598d6c6e3f8adf64f8c5773db7c23c9019f00c6842e240e57494fb7a4126b50151ca511a51180c3986505adbd2029a9b8c6942a5d0ea13cb6dde74cba657afce30b4c4c77b9b85b19c623cc4c356f811371dd8d57a7dfc23170d16c28e578242594818d0040fe659ca2ea42f718765011b443cd7b9849cdc470e8100994518a85351c6f7bba18c5bfea96fb1e6807edd5ac657bbb4", 0xa5}], 0x2, &(0x7f0000000700)=[@txtime={{0x18}}, @txtime={{0x18, 0x1, 0x3d, 0x401}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x3}}, @timestamping={{0x14, 0x1, 0x25, 0x1}}, @txtime={{0x18, 0x1, 0x3d, 0x8}}, @mark={{0x14, 0x1, 0x24, 0x4b0fd3d0}}, @mark={{0x14, 0x1, 0x24, 0xfffffff8}}, @txtime={{0x18, 0x1, 0x3d, 0x5ea2}}], 0xd8}, 0x44004) r3 = shmget(0x2, 0x3000, 0x8, &(0x7f0000ffb000/0x3000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000840)=""/170) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000900), 0x10f080, 0x0) ioctl$EVIOCGABS0(r4, 0x80184540, &(0x7f0000000940)=""/67) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r4, 0x89f5, &(0x7f0000000a40)={'ip6_vti0\x00', &(0x7f00000009c0)={'ip6gre0\x00', r2, 0x29, 0xff, 0x9, 0x20, 0x3c0036ffe48e3e0, @mcast1, @local, 0x7, 0x40, 0xc9f}}) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x3c, 0x0, 0x800, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4040010) 12:19:35 executing program 6: sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @mcast1}]}, 0x28}, 0x1, 0x0, 0x0, 0x48840}, 0x8001) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x5}, @NLBL_MGMT_A_DOMAIN={0x7, 0x1, '$\\\x00'}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_DOMAIN={0xc, 0x1, '}\xcd{:,[\\\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x15}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004004}, 0x4004) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8800) sendmsg$NLBL_MGMT_C_LISTALL(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x60, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, '[\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @mcast1}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @local}, @NLBL_MGMT_A_CV4DOI={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x68, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xdec2}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}]}, 0x68}, 0x1, 0x0, 0x0, 0x8001}, 0x64004824) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000005c0), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x108a}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x58, r3, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xf}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x40080) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r1) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x38, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @empty}}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x3c, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xffffffe1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xfffffffd}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8001}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40010}, 0x4) syz_genetlink_get_family_id$nbd(&(0x7f0000000980), r4) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000a00), 0x20000, 0x0) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x24, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}]}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x40) timerfd_create(0x4, 0x800) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000b80), r1) sendmsg$NLBL_MGMT_C_REMOVE(r1, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x48, r7, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_DOMAIN={0x7, 0x1, '&*\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x10}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) 12:19:35 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x80, 0x8430, 0x28, @local, @loopback, 0x40, 0x10, 0x2, 0x101}}) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x24, @short={0x2, 0x1, 0xfffe}}, 0x14, &(0x7f00000002c0)={&(0x7f0000000200)="7a75fe2664d28109f453bf348b9d378a0a312fe6cc9d9f4ca37cda5ecfed398ca6a70f630cc85f8ddd7e4d30919d05a847b33d0e770f6016ead640b25aa0a92d550b4227aa5aad670aaf6bd90b7d52e06e220afc4b9c03d8ddf824b00a16f07475a84662a1e00206c3df53f852419ca64733a2c4a21d5eee126a50fafadde8f9b1fee0cc4be52b33587abc17587824dde6cebb673d67e1ce6838", 0x9a}, 0x1, 0x0, 0x0, 0xc048041}, 0x24008085) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f0000000340)=""/117) ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f00000003c0)={0x68f, 0xc64f782, 0x9, 0x8001, 0x663c, 0x7b}) pipe2(&(0x7f0000000400)={0xffffffffffffffff}, 0xc4000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl2\x00', r1, 0x4, 0x6, 0x3f, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, 0x700, 0x40, 0x3, 0x7f}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000005c0)={'erspan0\x00', &(0x7f0000000500)={'gre0\x00', r5, 0xe, 0x8000, 0xffffa5b9, 0x8, {{0x1e, 0x4, 0x1, 0x20, 0x78, 0x64, 0x0, 0x1, 0x4, 0x0, @multicast1, @remote, {[@timestamp_addr={0x44, 0xc, 0x88, 0x1, 0x0, [{@rand_addr=0x64010101, 0x636}]}, @timestamp={0x44, 0x20, 0x16, 0x0, 0x3, [0x80000000, 0x4, 0x6414f949, 0x80000000, 0x5, 0x1, 0x10000]}, @timestamp={0x44, 0xc, 0xbe, 0x0, 0x0, [0xefa, 0x800]}, @noop, @noop, @cipso={0x86, 0x28, 0xffffffffffffffff, [{0x2, 0x12, "ff5dd655f40239e4e7c3ad059eb8433f"}, {0x1, 0x10, "8245f6889feafad28409defe2709"}]}]}}}}}) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000600), 0x1, 0x0) r6 = openat$sr(0xffffffffffffff9c, &(0x7f0000000640), 0x400800, 0x0) ioctl$RTC_EPOCH_READ(r6, 0x8008700d, &(0x7f0000000680)) pipe2(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r8 = openat$sr(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f00000007c0)={'syztnl1\x00', &(0x7f0000000740)={'syztnl2\x00', r1, 0x29, 0x6, 0x8, 0xff, 0xf5345baf6e4ef107, @mcast1, @empty, 0x40, 0x7800, 0x10001, 0xffffff80}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f0000000880)={'sit0\x00', &(0x7f0000000800)={'ip6_vti0\x00', r9, 0x4, 0x3, 0x1, 0x10001, 0x12, @remote, @remote, 0x80, 0x8, 0x7, 0x1f}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f0000000940)={'erspan0\x00', &(0x7f00000008c0)={'gretap0\x00', r5, 0x1, 0x80, 0x5, 0x2, {{0xb, 0x4, 0x1, 0x9, 0x2c, 0x65, 0x0, 0x9a, 0x2f, 0x0, @multicast1, @remote, {[@lsrr={0x83, 0x17, 0x69, [@dev={0xac, 0x14, 0x14, 0x29}, @remote, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000a00)={'syztnl0\x00', &(0x7f0000000980)={'syztnl2\x00', r5, 0x4, 0x3, 0x6, 0x2, 0x3a, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x8, 0xfff, 0xda97}}) socket$nl_generic(0x10, 0x3, 0x10) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000a40)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0202}}}, 0x14) [ 62.277591] audit: type=1400 audit(1763122775.582:7): avc: denied { execmem } for pid=274 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 63.514341] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 63.517055] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 63.518988] ================================================================== [ 63.520274] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x66d/0x6d0 [ 63.521489] Read of size 2 at addr ffff88800e65a2b8 by task kworker/u11:2/293 [ 63.528877] [ 63.529200] CPU: 0 UID: 0 PID: 293 Comm: kworker/u11:2 Not tainted 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary) [ 63.529234] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 63.529251] Workqueue: hci0 hci_cmd_work [ 63.529285] Call Trace: [ 63.529294] [ 63.529303] dump_stack_lvl+0xca/0x120 [ 63.529335] print_report+0xcb/0x610 [ 63.529367] ? __virt_addr_valid+0x100/0x5d0 [ 63.529396] ? hci_cmd_work+0x66d/0x6d0 [ 63.529427] ? hci_cmd_work+0x66d/0x6d0 [ 63.529459] kasan_report+0xca/0x100 [ 63.529490] ? hci_cmd_work+0x66d/0x6d0 [ 63.529525] hci_cmd_work+0x66d/0x6d0 [ 63.529558] process_one_work+0x8e1/0x19c0 [ 63.529600] ? __pfx_process_one_work+0x10/0x10 [ 63.529636] ? move_linked_works+0x172/0x270 [ 63.529663] ? assign_work+0x196/0x240 [ 63.529698] worker_thread+0x67e/0xe90 [ 63.529733] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 63.529763] ? __pfx_worker_thread+0x10/0x10 [ 63.529799] kthread+0x3c8/0x740 [ 63.529830] ? __pfx_kthread+0x10/0x10 [ 63.529860] ? ret_from_fork+0x79/0x7a0 [ 63.529885] ? lock_release+0xc8/0x290 [ 63.529922] ? __pfx_kthread+0x10/0x10 [ 63.529969] ret_from_fork+0x67a/0x7a0 [ 63.529994] ? __pfx_ret_from_fork+0x10/0x10 [ 63.530020] ? __switch_to+0x759/0x1060 [ 63.530054] ? __pfx_kthread+0x10/0x10 [ 63.530086] ret_from_fork_asm+0x1a/0x30 [ 63.530127] [ 63.530135] [ 63.552909] Allocated by task 290: [ 63.553536] kasan_save_stack+0x24/0x50 [ 63.554255] kasan_save_track+0x14/0x30 [ 63.554962] __kasan_slab_alloc+0x59/0x70 [ 63.555701] kmem_cache_alloc_node_noprof+0x228/0x6b0 [ 63.556621] __alloc_skb+0x2ab/0x370 [ 63.557298] hci_cmd_sync_alloc+0x34/0x300 [ 63.558065] __hci_cmd_sync_sk+0xf7/0x5c0 [ 63.558820] hci_read_local_version_sync+0x2c/0x170 [ 63.559705] hci_dev_open_sync+0x145c/0x1f60 [ 63.560489] hci_power_on+0xdb/0x5d0 [ 63.561150] process_one_work+0x8e1/0x19c0 [ 63.561918] worker_thread+0x67e/0xe90 [ 63.562644] kthread+0x3c8/0x740 [ 63.563260] ret_from_fork+0x67a/0x7a0 [ 63.563954] ret_from_fork_asm+0x1a/0x30 [ 63.564682] [ 63.564986] Freed by task 291: [ 63.565554] kasan_save_stack+0x24/0x50 [ 63.566271] kasan_save_track+0x14/0x30 [ 63.566986] kasan_save_free_info+0x3a/0x60 [ 63.567763] __kasan_slab_free+0x43/0x70 [ 63.568478] kmem_cache_free+0x26f/0x500 [ 63.569217] kfree_skbmem+0x18a/0x1f0 [ 63.569909] sk_skb_reason_drop+0x10e/0x1b0 [ 63.570689] vhci_read+0x3d5/0x5d0 [ 63.571325] vfs_read+0x1eb/0xc70 [ 63.571946] ksys_read+0x121/0x240 [ 63.572578] do_syscall_64+0xbf/0x430 [ 63.573268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.574197] [ 63.574507] The buggy address belongs to the object at ffff88800e65a280 [ 63.574507] which belongs to the cache skbuff_head_cache of size 232 [ 63.576736] The buggy address is located 56 bytes inside of [ 63.576736] freed 232-byte region [ffff88800e65a280, ffff88800e65a368) [ 63.578841] [ 63.579149] The buggy address belongs to the physical page: [ 63.580114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe65a [ 63.581479] memcg:ffff88800967bd81 [ 63.582108] anon flags: 0x100000000000000(node=0|zone=1) [ 63.583052] page_type: f5(slab) [ 63.583655] raw: 0100000000000000 ffff8880096c78c0 0000000000000000 dead000000000001 [ 63.585005] raw: 0000000000000000 00000000000c000c 00000000f5000000 ffff88800967bd81 [ 63.586349] page dumped because: kasan: bad access detected [ 63.587333] [ 63.587637] Memory state around the buggy address: [ 63.588491] ffff88800e65a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.589771] ffff88800e65a200: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 63.590900] >ffff88800e65a280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.591937] ^ [ 63.592683] ffff88800e65a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 63.593717] ffff88800e65a380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 63.594756] ================================================================== [ 63.595914] Disabling lock debugging due to kernel taint [ 63.598354] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 63.599725] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 63.601422] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 63.601732] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 63.604323] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 63.607935] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 63.615185] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 63.624081] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 63.625559] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.633214] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 63.638904] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 63.638972] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 63.641597] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 63.643683] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 63.645375] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 63.645683] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 63.647603] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 63.649261] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 63.651620] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 63.653205] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 63.654682] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 63.656538] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 63.663435] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 63.667883] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 63.669850] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 63.671482] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 63.673167] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 63.674599] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 63.676716] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 63.678455] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 63.683836] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 63.685533] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 63.688272] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 63.689415] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 63.690572] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 63.694773] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 63.700671] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 63.709751] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 65.674312] Bluetooth: hci1: command tx timeout [ 65.675119] Bluetooth: hci0: command tx timeout [ 65.738093] Bluetooth: hci3: command tx timeout [ 65.739126] Bluetooth: hci7: command tx timeout [ 65.739170] Bluetooth: hci4: command tx timeout [ 65.739807] Bluetooth: hci5: command tx timeout [ 65.740510] Bluetooth: hci2: command tx timeout [ 65.741128] Bluetooth: hci6: command tx timeout [ 67.722236] Bluetooth: hci0: command tx timeout [ 67.722802] Bluetooth: hci1: command tx timeout [ 67.786055] Bluetooth: hci6: command tx timeout [ 67.786586] Bluetooth: hci3: command tx timeout [ 67.787148] Bluetooth: hci2: command tx timeout [ 67.787342] Bluetooth: hci5: command tx timeout [ 67.787602] Bluetooth: hci4: command tx timeout [ 67.788464] Bluetooth: hci7: command tx timeout [ 69.770059] Bluetooth: hci1: command tx timeout [ 69.770494] Bluetooth: hci0: command tx timeout [ 69.834115] Bluetooth: hci4: command tx timeout [ 69.834140] Bluetooth: hci5: command tx timeout [ 69.834163] Bluetooth: hci2: command tx timeout [ 69.834174] Bluetooth: hci3: command tx timeout [ 69.834185] Bluetooth: hci6: command tx timeout [ 69.834194] Bluetooth: hci7: command tx timeout [ 71.819020] Bluetooth: hci0: command tx timeout [ 71.819477] Bluetooth: hci1: command tx timeout [ 71.882073] Bluetooth: hci7: command tx timeout [ 71.882518] Bluetooth: hci6: command tx timeout [ 71.882540] Bluetooth: hci3: command tx timeout [ 71.883322] Bluetooth: hci2: command tx timeout [ 71.883363] Bluetooth: hci5: command tx timeout [ 71.883677] Bluetooth: hci4: command tx timeout VM DIAGNOSIS: 12:19:36 Registers: info registers vcpu 0 RAX=0000000000000031 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff8293dd05 RDI=ffffffff889747c0 RBP=ffffffff88974780 RSP=ffff888015fa7618 R8 =0000000000000000 R9 =ffffed10016fb046 R10=0000000000000031 R11=6530303838386652 R12=0000000000000031 R13=0000000000000010 R14=ffffffff88974780 R15=ffffffff8293dcf0 RIP=ffffffff8293dd5d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e538f000 00000000 00000000 LDT=0000 fffffe6a00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f19b4a46070 CR3=000000000ddac000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f19b4b097c000007f19b4b097c8 XMM02=00007f19b4b097e000007f19b4b097c0 XMM03=00007f19b4b097c800007f19b4b097c0 XMM04=ffffffffffffffffffffffffffffff00 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=00000000000081a4 RCX=ffffffff81c12d15 RDX=ffff888017668000 RSI=0000000000000000 RDI=0000000000000000 RBP=ffff888016c266e8 RSP=ffff88801b577bb8 R8 =0000000000000001 R9 =ffffed1002d84cf9 R10=0000000000000000 R11=0000000000000001 R12=0000000000000000 R13=ffffffff85f2b1a0 R14=0000000000000000 R15=00000000000081a4 RIP=ffffffff81752ee8 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f76edf1d8c0 00000000 00000000 GS =0000 ffff8880e548f000 00000000 00000000 LDT=0000 fffffe4400000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000561d9ef51a98 CR3=000000000a186000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=25252525252525252525252525252525 XMM01=0000ff0000ff0000ff0000ff0000ff00 XMM02=0000ff0000000000ff0000000000ff00 XMM03=00326c6c696b66723a6c6c696b66722b XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000005000000020000561d9eed6710 XMM06=00000000000000000000000100000004 XMM07=00000000000000000000000000000000 XMM08=3a56000a73253a51000a73253a47000a XMM09=00000000000000000000000000000000 XMM10=00000000002000000000000000200000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000