last executing test programs: 476.276847ms ago: executing program 3 (id=4): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=@base={0x5, 0x4, 0xfff, 0x7}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000080850000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f00000021c0)={r2, 0x0, 0x0}, 0x10) 465.408604ms ago: executing program 4 (id=5): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001ac0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112b0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01ac69398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc786b409ac930c90ff90f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d858952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ef6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b6214912a517810200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09e3187a10d905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367638cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734837ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a6d072034cecc457776c5fa1f33b0203c07052c6bc314b0ac5c63bc2083c9cda0b7480e0b17854ffcc76176ce266bc698f7921b8afe798a7a5ed33ab0374455ee368fda99a0e681bf9426831b193395cb01a7332a50aac841cb7d48a1768a7640a9820631ba775a2d4f12e8e717eaaa2a6d14fee0c15f36c203dbc7c06128bec84231d43e152ef19ce027436fb4ebb9fce431b913f4817597a6f53d1626f9d1cb7b36fb18ac19547a8b20ede70c81a75686cea85dcd34408128da7cab045541bc6b9a0a79f63f2e7646356e04b977c9f47467537015240b974184be9c54b7c628ae4d97ebdb06070344468994afbaac71e5ffac2c61d9af66f9de2760a38e968a781528531c1c936a02065be48f1eee77be878873206d65bd0b1241fab9139abd7f40febe81fed3684e6b59273da01f1743c6a5df300ec59c65e8174fc2d95a62ca7b937289ad14107333007eab833a5849eb19f18ae41743dfb949377e"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xfe, 0x60000000, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff60124000632b77fbac141416ac141416440805034d2f87e5940c05ab845013f2325f1a39010702038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) 396.944907ms ago: executing program 0 (id=1): bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x12, 0x9, 0x4, 0x2, 0x240, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x10000000, 0x0, 0x2000}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp\x00') mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) epoll_create1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pread64(r0, &(0x7f0000000000)=""/25, 0x19, 0xb6) 262.781505ms ago: executing program 2 (id=3): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @dev}) 239.437009ms ago: executing program 1 (id=9): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000480)={@multicast, @random="fad1e0480100", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty=0xe0000001}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x8f, 0x100}}}}}}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000180)={@multicast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x6b, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x3, 0xf, 0x100, @val=0x80}}}}}}}, 0x0) 223.954625ms ago: executing program 1 (id=10): socket$packet(0x11, 0x2, 0x300) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, 0x0, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r1, &(0x7f0000000300)="89ba41c97928dec7cec15a160d3dba2553b519a795020072aed129d4b5247c983455b3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba20d03474a4a4bce636ea8d2b882b2b49ef18e2a96e41f206d930eda2769c5ee6d5e3d541ce9a21c3ce5cb5fbdad9a45de0000000000000000000000000000f1d3b9821c18", 0x80) 207.078491ms ago: executing program 1 (id=11): socket(0x40000000015, 0x5, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe(&(0x7f00000002c0)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) socket(0x10, 0x803, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r4, @ANYRES32=r4], 0x44}}, 0x2000800) 181.661135ms ago: executing program 2 (id=12): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='cdg', 0x3) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000700)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff959bcecc7a95425a3a07e758044ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x994b6e03113064ae, 0x0, 0x0, 0x0) 156.723469ms ago: executing program 1 (id=13): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x82, &(0x7f0000000300)=ANY=[], 0x0) 129.112172ms ago: executing program 4 (id=14): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080c1}, 0x40000880) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0xff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 118.661579ms ago: executing program 1 (id=15): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e999"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001c"], 0xb8}}, 0x0) 74.412458ms ago: executing program 3 (id=16): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000013000000850000000c000000b707000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) socket(0x10, 0x803, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) socket$unix(0x1, 0x5, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r3, @ANYRES32=r3], 0x44}}, 0x2000800) 61.922515ms ago: executing program 1 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000600)=""/244, 0xf4}, {&(0x7f00000003c0)=""/222, 0xde}, {&(0x7f0000000800)=""/222, 0xde}, {&(0x7f00000004c0)=""/200, 0xc8}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000000240)=""/171, 0xab}], 0x6, 0x0, 0xfffffdeb}, 0x22120) recvmmsg(r0, &(0x7f0000001800)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x10102, 0x0) 31.159078ms ago: executing program 3 (id=18): r0 = socket$inet6(0xa, 0x80002, 0x7ffb) bind$inet6(r0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20040884}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000300)='cgroup.controllers\x00', 0x275a, 0xfffe) preadv(r2, &(0x7f0000000100), 0xa, 0x0, 0x0) 19.725395ms ago: executing program 3 (id=19): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000), 0x4) 8.332353ms ago: executing program 3 (id=20): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) readv(r0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/189, 0xbd}], 0x1) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r2], 0x20}}, 0x0) 0s ago: executing program 4 (id=21): bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xffffffffffffffff, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts. [ 22.015262][ T30] audit: type=1400 audit(1772030609.774:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.016606][ T273] cgroup: Unknown subsys name 'net' [ 22.038826][ T30] audit: type=1400 audit(1772030609.774:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.066890][ T30] audit: type=1400 audit(1772030609.804:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.067101][ T273] cgroup: Unknown subsys name 'devices' [ 22.207310][ T273] cgroup: Unknown subsys name 'hugetlb' [ 22.213198][ T273] cgroup: Unknown subsys name 'rlimit' [ 22.353929][ T30] audit: type=1400 audit(1772030610.104:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.377653][ T30] audit: type=1400 audit(1772030610.104:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.402960][ T30] audit: type=1400 audit(1772030610.104:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.408116][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.435754][ T30] audit: type=1400 audit(1772030610.194:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.461944][ T30] audit: type=1400 audit(1772030610.194:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.472470][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.488312][ T30] audit: type=1400 audit(1772030610.224:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.522828][ T30] audit: type=1400 audit(1772030610.224:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.270417][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.277883][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.285391][ T281] device bridge_slave_0 entered promiscuous mode [ 23.293587][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.300772][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.308316][ T281] device bridge_slave_1 entered promiscuous mode [ 23.366829][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.373893][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.381423][ T283] device bridge_slave_0 entered promiscuous mode [ 23.390044][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.397176][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.405042][ T283] device bridge_slave_1 entered promiscuous mode [ 23.486200][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.493909][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.501577][ T282] device bridge_slave_0 entered promiscuous mode [ 23.508770][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.516013][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.523426][ T282] device bridge_slave_1 entered promiscuous mode [ 23.546110][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.553405][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.561423][ T284] device bridge_slave_0 entered promiscuous mode [ 23.568721][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.576284][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.583834][ T284] device bridge_slave_1 entered promiscuous mode [ 23.628874][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.636099][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.643838][ T285] device bridge_slave_0 entered promiscuous mode [ 23.651046][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.658536][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.666055][ T285] device bridge_slave_1 entered promiscuous mode [ 23.800722][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.808023][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.815464][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.822481][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.832899][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.839975][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.847420][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.854898][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.868484][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.875542][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.882801][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.890183][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.924140][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.931533][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.938873][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.946181][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.961122][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.968203][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.975489][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.982504][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.008584][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.016028][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.023396][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.031235][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.039305][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.046661][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.054021][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.061515][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.069618][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.077556][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.086148][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.093820][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.117601][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.126081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.133961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.143050][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.150687][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.158785][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.167319][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.174513][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.182057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.190358][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.197493][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.205158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.213289][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.220418][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.227931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.259302][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.267793][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.274822][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.282610][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.291471][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.299015][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.306457][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.315013][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.323186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.331318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.339428][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.347028][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.354519][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.363107][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.371289][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.378492][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.386467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.395034][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.403272][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.410513][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.418369][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.426645][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.450479][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.458180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.465953][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.474491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.482992][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.490161][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.497906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.506622][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.515501][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.522693][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.530141][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.538810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.558436][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.567124][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.575823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.584161][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.592414][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.601154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.611878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.620411][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.634619][ T281] device veth0_vlan entered promiscuous mode [ 24.643234][ T283] device veth0_vlan entered promiscuous mode [ 24.649832][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.658094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.666991][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.674885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.682833][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.690529][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.698523][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.706770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.716917][ T282] device veth0_vlan entered promiscuous mode [ 24.727571][ T285] device veth0_vlan entered promiscuous mode [ 24.735972][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.744370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.752821][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.760512][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.768461][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.776548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.784460][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.792060][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.807343][ T282] device veth1_macvtap entered promiscuous mode [ 24.814061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.822338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.830818][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.839304][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.847659][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.857712][ T281] device veth1_macvtap entered promiscuous mode [ 24.869576][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.878148][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.886326][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.893797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.907383][ T283] device veth1_macvtap entered promiscuous mode [ 24.915137][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.923440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.932105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.941105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.949621][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.960847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.969565][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.978803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.987416][ T284] device veth0_vlan entered promiscuous mode [ 24.998815][ T285] device veth1_macvtap entered promiscuous mode [ 25.005875][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.014293][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.030368][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.040375][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.049018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.057581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.067569][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.076150][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.096887][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 25.108174][ T284] device veth1_macvtap entered promiscuous mode [ 25.115865][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.124338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.132896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.172560][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.192831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.237822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.248573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.258929][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.270208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.480908][ T369] Illegal XDP return value 4294967294, expect packet loss! [ 25.517225][ T373] device syzkaller0 entered promiscuous mode [ 25.526854][ T372] netlink: 164 bytes leftover after parsing attributes in process `syz.1.15'. [ 25.529617][ T373] tipc: Started in network mode [ 25.541884][ T373] tipc: Node identity 3672d3162848, cluster identity 4711 [ 25.550123][ T373] tipc: Enabled bearer , priority 0 [ 25.572110][ T370] tipc: Resetting bearer [ 25.580766][ T370] tipc: Disabling bearer [ 25.633413][ T385] ================================================================== [ 25.641518][ T385] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x870/0x3240 [ 25.649705][ T385] Read of size 8 at addr ffff88810f8c4ec0 by task syz.4.21/385 [ 25.657249][ T385] [ 25.659666][ T385] CPU: 1 PID: 385 Comm: syz.4.21 Not tainted syzkaller #0 [ 25.666783][ T385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 25.676936][ T385] Call Trace: [ 25.680213][ T385] [ 25.683150][ T385] __dump_stack+0x21/0x30 [ 25.687523][ T385] dump_stack_lvl+0x110/0x170 [ 25.692322][ T385] ? show_regs_print_info+0x20/0x20 [ 25.697508][ T385] ? load_image+0x3e0/0x3e0 [ 25.701999][ T385] print_address_description+0x7f/0x2c0 [ 25.707701][ T385] ? tc_setup_flow_action+0x870/0x3240 [ 25.713268][ T385] kasan_report+0xf1/0x140 [ 25.717951][ T385] ? tc_setup_flow_action+0x870/0x3240 [ 25.723431][ T385] __asan_report_load8_noabort+0x14/0x20 [ 25.729361][ T385] tc_setup_flow_action+0x870/0x3240 [ 25.734812][ T385] mall_replace_hw_filter+0x2cc/0x8b0 [ 25.740390][ T385] ? pcpu_block_update_hint_alloc+0x8c4/0xc50 [ 25.746648][ T385] ? mall_set_parms+0x520/0x520 [ 25.752025][ T385] ? tcf_exts_destroy+0xb0/0xb0 [ 25.756954][ T385] ? pcpu_alloc+0x1170/0x16e0 [ 25.761728][ T385] ? mall_set_parms+0x1e8/0x520 [ 25.766766][ T385] mall_change+0x544/0x760 [ 25.771257][ T385] ? __kasan_check_write+0x14/0x20 [ 25.776367][ T385] ? mall_get+0xa0/0xa0 [ 25.780542][ T385] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 25.786510][ T385] tc_new_tfilter+0x12e5/0x18e0 [ 25.791537][ T385] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.797338][ T385] ? security_capable+0x87/0xb0 [ 25.802247][ T385] ? ns_capable+0x8c/0xf0 [ 25.807354][ T385] ? netlink_net_capable+0x125/0x160 [ 25.813085][ T385] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.818725][ T385] rtnetlink_rcv_msg+0x871/0xce0 [ 25.823703][ T385] ? rtnetlink_bind+0x80/0x80 [ 25.828453][ T385] ? avc_has_perm_noaudit+0x391/0x490 [ 25.833818][ T385] ? memcpy+0x56/0x70 [ 25.837912][ T385] ? avc_has_perm_noaudit+0x30b/0x490 [ 25.843290][ T385] ? arch_stack_walk+0xee/0x140 [ 25.848567][ T385] ? avc_denied+0x1b0/0x1b0 [ 25.853057][ T385] ? stack_trace_save+0xa6/0xf0 [ 25.857894][ T385] ? avc_has_perm+0x163/0x250 [ 25.862557][ T385] ? avc_has_perm_noaudit+0x490/0x490 [ 25.868004][ T385] ? x64_sys_call+0x4b/0x9a0 [ 25.872771][ T385] ? selinux_nlmsg_lookup+0x416/0x4c0 [ 25.878392][ T385] netlink_rcv_skb+0x1f5/0x440 [ 25.883156][ T385] ? rtnetlink_bind+0x80/0x80 [ 25.887880][ T385] ? netlink_ack+0xb50/0xb50 [ 25.892718][ T385] ? __netlink_lookup+0x387/0x3b0 [ 25.897931][ T385] rtnetlink_rcv+0x1c/0x20 [ 25.902371][ T385] netlink_unicast+0x876/0xa40 [ 25.907322][ T385] netlink_sendmsg+0x879/0xb80 [ 25.912111][ T385] ? netlink_getsockopt+0x530/0x530 [ 25.917484][ T385] ? do_futex+0xde8/0x2800 [ 25.921895][ T385] ? security_socket_sendmsg+0x82/0xa0 [ 25.927339][ T385] ? netlink_getsockopt+0x530/0x530 [ 25.932612][ T385] ____sys_sendmsg+0x5b7/0x8f0 [ 25.937369][ T385] ? __sys_sendmsg_sock+0x40/0x40 [ 25.942745][ T385] ? import_iovec+0x7c/0xb0 [ 25.947333][ T385] ___sys_sendmsg+0x236/0x2e0 [ 25.952016][ T385] ? __sys_sendmsg+0x280/0x280 [ 25.956890][ T385] ? sock_show_fdinfo+0xa0/0xa0 [ 25.962273][ T385] ? __fdget+0x1a1/0x230 [ 25.966595][ T385] __x64_sys_sendmsg+0x206/0x2f0 [ 25.971523][ T385] ? ___sys_sendmsg+0x2e0/0x2e0 [ 25.976647][ T385] ? __kasan_check_write+0x14/0x20 [ 25.981870][ T385] ? switch_fpu_return+0x15d/0x2c0 [ 25.989378][ T385] x64_sys_call+0x4b/0x9a0 [ 25.994530][ T385] do_syscall_64+0x4c/0xa0 [ 26.001852][ T385] ? clear_bhb_loop+0x50/0xa0 [ 26.008552][ T385] ? clear_bhb_loop+0x50/0xa0 [ 26.014919][ T385] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.022210][ T385] RIP: 0033:0x7f18ae411629 [ 26.026820][ T385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.047989][ T385] RSP: 002b:00007f18ace6c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.057591][ T385] RAX: ffffffffffffffda RBX: 00007f18ae68afa0 RCX: 00007f18ae411629 [ 26.065869][ T385] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000005 [ 26.075182][ T385] RBP: 00007f18ae4a7b39 R08: 0000000000000000 R09: 0000000000000000 [ 26.083528][ T385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.091683][ T385] R13: 00007f18ae68b038 R14: 00007f18ae68afa0 R15: 00007ffd4bfc3878 [ 26.099844][ T385] [ 26.102851][ T385] [ 26.105589][ T385] Allocated by task 385: [ 26.109812][ T385] __kasan_kmalloc+0xda/0x110 [ 26.114596][ T385] __kmalloc+0x13d/0x2c0 [ 26.118845][ T385] tcf_idr_create+0x5f/0x790 [ 26.123531][ T385] tcf_idr_create_from_flags+0x61/0x70 [ 26.129292][ T385] tcf_gact_init+0x342/0x570 [ 26.133864][ T385] tcf_action_init_1+0x3ff/0x6b0 [ 26.138817][ T385] tcf_action_init+0x233/0x7a0 [ 26.143566][ T385] tcf_exts_validate+0x24a/0x580 [ 26.148512][ T385] mall_set_parms+0x48/0x520 [ 26.153402][ T385] mall_change+0x478/0x760 [ 26.157819][ T385] tc_new_tfilter+0x12e5/0x18e0 [ 26.162685][ T385] rtnetlink_rcv_msg+0x871/0xce0 [ 26.168103][ T385] netlink_rcv_skb+0x1f5/0x440 [ 26.172879][ T385] rtnetlink_rcv+0x1c/0x20 [ 26.177285][ T385] netlink_unicast+0x876/0xa40 [ 26.182577][ T385] netlink_sendmsg+0x879/0xb80 [ 26.187323][ T385] ____sys_sendmsg+0x5b7/0x8f0 [ 26.192254][ T385] ___sys_sendmsg+0x236/0x2e0 [ 26.197002][ T385] __x64_sys_sendmsg+0x206/0x2f0 [ 26.202017][ T385] x64_sys_call+0x4b/0x9a0 [ 26.206415][ T385] do_syscall_64+0x4c/0xa0 [ 26.210820][ T385] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.216846][ T385] [ 26.219297][ T385] The buggy address belongs to the object at ffff88810f8c4e00 [ 26.219297][ T385] which belongs to the cache kmalloc-192 of size 192 [ 26.233437][ T385] The buggy address is located 0 bytes to the right of [ 26.233437][ T385] 192-byte region [ffff88810f8c4e00, ffff88810f8c4ec0) [ 26.247440][ T385] The buggy address belongs to the page: [ 26.253066][ T385] page:ffffea00043e3100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f8c4 [ 26.263568][ T385] flags: 0x4000000000000200(slab|zone=1) [ 26.269299][ T385] raw: 4000000000000200 ffffea00043e2fc0 0000000200000002 ffff888100042c00 [ 26.278325][ T385] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.287421][ T385] page dumped because: kasan: bad access detected [ 26.293839][ T385] page_owner tracks the page as allocated [ 26.299908][ T385] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 4951206763, free_ts 4951182822 [ 26.315802][ T385] post_alloc_hook+0x192/0x1b0 [ 26.320613][ T385] prep_new_page+0x1c/0x110 [ 26.325113][ T385] get_page_from_freelist+0x2d3a/0x2dc0 [ 26.330754][ T385] __alloc_pages+0x1a2/0x460 [ 26.335352][ T385] new_slab+0xa1/0x4d0 [ 26.339630][ T385] ___slab_alloc+0x381/0x810 [ 26.344326][ T385] __slab_alloc+0x49/0x90 [ 26.348763][ T385] kmem_cache_alloc_trace+0x146/0x270 [ 26.354140][ T385] kernfs_fop_open+0x343/0xb30 [ 26.358896][ T385] do_dentry_open+0x834/0x1010 [ 26.363679][ T385] vfs_open+0x73/0x80 [ 26.367663][ T385] path_openat+0x26a6/0x2f20 [ 26.372435][ T385] do_filp_open+0x1e2/0x410 [ 26.376987][ T385] do_sys_openat2+0x15e/0x7f0 [ 26.381661][ T385] __x64_sys_openat+0x136/0x160 [ 26.386499][ T385] x64_sys_call+0x219/0x9a0 [ 26.390988][ T385] page last free stack trace: [ 26.396362][ T385] free_unref_page_prepare+0x542/0x550 [ 26.402061][ T385] free_unref_page+0xae/0x540 [ 26.407282][ T385] __free_pages+0x6c/0x100 [ 26.411916][ T385] free_pages+0x82/0x90 [ 26.416310][ T385] selinux_genfs_get_sid+0x20b/0x250 [ 26.421758][ T385] inode_doinit_with_dentry+0x87a/0xd80 [ 26.427290][ T385] selinux_d_instantiate+0x27/0x40 [ 26.432620][ T385] security_d_instantiate+0x9e/0xf0 [ 26.437981][ T385] d_splice_alias+0x6d/0x390 [ 26.442760][ T385] kernfs_iop_lookup+0x2c2/0x310 [ 26.447705][ T385] path_openat+0xfc9/0x2f20 [ 26.452300][ T385] do_filp_open+0x1e2/0x410 [ 26.456814][ T385] do_sys_openat2+0x15e/0x7f0 [ 26.461555][ T385] __x64_sys_openat+0x136/0x160 [ 26.466499][ T385] x64_sys_call+0x219/0x9a0 [ 26.471005][ T385] do_syscall_64+0x4c/0xa0 [ 26.475410][ T385] [ 26.477719][ T385] Memory state around the buggy address: [ 26.483420][ T385] ffff88810f8c4d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.491762][ T385] ffff88810f8c4e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.500134][ T385] >ffff88810f8c4e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.508657][ T385] ^ [ 26.514811][ T385] ffff88810f8c4f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.523225][ T385] ffff88810f8c4f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.531425][ T385] ================================================================== [ 26.539648][ T385] Disabling lock debugging due to kernel taint