last executing test programs: 1.28893194s ago: executing program 4 (id=5): r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000000)={'TPROXY\x00'}, &(0x7f00000000c0)=0x1e) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x0, &(0x7f0000000840), 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @random="5138ad81df73"}]}, 0x40}}, 0x0) 965.03564ms ago: executing program 4 (id=6): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = open(&(0x7f0000000100)='./file0\x00', 0x10002, 0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0x3, 0x3, 0x9, 0x0, 0x6}}) getrandom(0x0, 0x0, 0x0) r1 = getpid() (async, rerun: 64) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 64) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) (async) kcmp(r1, r2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) r3 = syz_usb_connect$cdc_ncm(0x0, 0x7b, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x2, 0x1, 0x0, 0x0, 0x4, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6, 0x24, 0x1a, 0x2, 0x20}, [@mbim_extended={0x8, 0x24, 0x1c, 0x4ce5, 0x8, 0xe4b}, @call_mgmt={0x5, 0x24, 0x1, 0x6, 0x9}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0xfd}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) (async) openat(0xffffffffffffff9c, 0x0, 0x88040, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0xfff, 0x4010, 0x10, 0x4, 0x10, 0x10, 0x10, 0x10, 0x14, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) openat$cgroup_ro(r0, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) 822.778135ms ago: executing program 2 (id=13): socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x4, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 820.059575ms ago: executing program 2 (id=14): syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100fdffffff000000001e00000008000300", @ANYRES32=r2], 0x5c}}, 0x800) 807.077795ms ago: executing program 2 (id=15): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x5, 0x3, 'Y'}]}], {0x14}}, 0x50}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a3000000000090003"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a38000000030a03000000000000000000020000000900010073797a30000000000900030000000000000003000c000240000000000000000114000000110001"], 0x60}}, 0x0) 740.946017ms ago: executing program 2 (id=17): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 740.819017ms ago: executing program 2 (id=18): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)='wi\n', 0x3}], 0x1, 0x1) r5 = socket$netlink(0x10, 0x3, 0x0) splice(r3, 0x0, r5, 0x0, 0x10d00, 0xf) 719.717437ms ago: executing program 2 (id=20): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='htcp', 0x4) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 367.217549ms ago: executing program 0 (id=39): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0x30, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x46}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@nested={0x8, 0xb, 0x0, 0x1, [@typed={0x4, 0x4e}]}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r0}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008801}, 0x4008094) 305.026711ms ago: executing program 0 (id=40): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0xc8}}, 0x0) 304.887771ms ago: executing program 0 (id=41): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x18, r1, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x18}}, 0x0) 304.74688ms ago: executing program 0 (id=42): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x6f}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="0000800000000180c200000086dd"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x2004c085) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r0, 0x5, 0x26, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) socket(0x10, 0x3, 0x0) 304.636431ms ago: executing program 0 (id=43): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004080)={0x34, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x9, 0x1c, 0x0, 0x0, @binary="8b0adf34c2"}]}, @nested={0x4, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 303.374271ms ago: executing program 0 (id=45): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='scalable', 0x8) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 91.647077ms ago: executing program 3 (id=64): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan1\x00'}) 91.579877ms ago: executing program 3 (id=65): socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000006c0001002abd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="91d88600408200001400030064756d6d7930000000000e000000000004003480"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x40000) 91.402527ms ago: executing program 3 (id=67): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='yeah', 0x4) 46.003928ms ago: executing program 3 (id=68): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)}}, 0x40) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r9, 0x4) 45.712928ms ago: executing program 1 (id=69): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002940)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x4, 0x0, 0x10000000, 0x0, 0x9d64}, 0x2, 0x6}, [{0x8, 0x1ff, 0x8, 0xe, 0x7, 0x5}, {0x4, 0x400, 0x8001, 0xa, 0xc, 0x4}, {0x8c82, 0x2, 0x7, 0x101, 0x9, 0x4}, {0x200, 0x8, 0x9, 0x3, 0x400, 0x2}, {0x63, 0xf, 0x0, 0xe, 0x977, 0x506d}, {0x2, 0x100, 0xbf1e, 0x5, 0x100, 0x5}, {0x3, 0x4, 0x6, 0x3243921, 0x7, 0x2}, {0x2, 0x4, 0x800, 0x2, 0x8}, {0x4, 0x3, 0x400, 0xffff, 0x0, 0x1ff}, {0x9, 0x3, 0x1, 0x5b8e5501, 0x4f45, 0xc14c}, {0x10001, 0x2, 0xd825, 0x8, 0x800, 0x7}, {0xfffffff8, 0x0, 0xe53, 0x84, 0x9, 0xfffffff3}, {0x0, 0x3, 0x2, 0x80000001, 0x200, 0x6}, {0x7fff, 0xffffffb4, 0x6, 0x3, 0x2, 0x550}, {0xf, 0x6, 0x6, 0x3ca, 0x1, 0x100}, {0x2, 0x7, 0x3, 0x0, 0xd7, 0x8}, {0x5f2d, 0x7ff, 0x81, 0x7, 0x5, 0x5}, {0x2, 0x7ff, 0x1, 0x4, 0x9, 0x8}, {0x1, 0x0, 0x10000, 0xfffff05b, 0x81, 0x7}, {0x68, 0x3, 0xfce, 0x0, 0x5, 0xec83}, {0x4, 0xfffffffd, 0xe, 0x8, 0x8, 0x5}, {0x400, 0xe, 0x2, 0x1ff, 0x3, 0x81}, {0x5, 0xfff, 0x3, 0x3, 0x3, 0xa3}, {0x7d1, 0x7, 0x5, 0x10, 0xea, 0x3ff}, {0x200, 0xfff, 0x7, 0x3, 0x5, 0x6}, {0x1, 0x0, 0x2, 0x2, 0x7, 0xfffff742}, {0x9, 0x7, 0x2, 0x1b7d, 0x401, 0x200}, {0xfffffff5, 0x0, 0x4, 0xa4, 0x9, 0x744}, {0x3, 0x6, 0x3, 0x5, 0x2, 0x1}, {0x9, 0x545, 0x1ff, 0x962c4c1, 0x6, 0x3}, {0x3, 0x1, 0x4, 0x10001, 0x9, 0x8}, {0xffffffff, 0x7, 0x8, 0x2, 0x3, 0x8}, {0x2, 0x4, 0x3, 0xfffffff8, 0x4, 0x8000}, {0xe, 0x0, 0x5, 0x1, 0x98a, 0x5}, {0x7, 0x7, 0x6, 0x7897d335, 0x3, 0xe5f2}, {0x5, 0x2, 0x9, 0x9, 0x3, 0x3}, {0x1b, 0x9, 0xffffffff, 0x9, 0x7, 0x284}, {0x4, 0x2, 0xa0000000, 0x4, 0xfffffe01, 0x1ff}, {0x10001, 0xfffffffa, 0x4, 0x100, 0x2, 0xa}, {0x2, 0x7ff, 0x1, 0x14c0, 0x2, 0x7fff}, {0x9b6, 0x3, 0xb, 0x8, 0x81, 0x2}, {0x80000000, 0x9, 0x1ff, 0x1, 0x9, 0x1}, {0x3, 0x3ff, 0x80000001, 0x1, 0x0, 0x26c}, {0x8, 0xd5, 0x2, 0x4, 0xfff, 0xcfc2}, {0x6, 0x8, 0x8, 0x0, 0x9, 0x401}, {0xf6, 0x5, 0xffffffff, 0x8, 0x1, 0x2ed7}, {0x7, 0x0, 0x1, 0x9, 0x21}, {0x5, 0x9, 0x26f3, 0x9, 0x1, 0xfd7b}, {0x0, 0xa7d3, 0x7, 0x24ec, 0x7, 0x7ff}, {0x80000000, 0xc, 0x7fff, 0x80000000, 0x800, 0x7f}, {0xa9b, 0x8, 0x5eed, 0x2, 0x40, 0x4}, {0x8, 0x3, 0x4, 0x7fff, 0x3, 0x2}, {0x0, 0x1000, 0x3, 0x8001, 0x1, 0x9}, {0xd, 0x9, 0x6, 0x6, 0x9, 0x800}, {0x100, 0x0, 0xb30, 0x84e, 0x5, 0x4}, {0x8000, 0x4, 0x539, 0x0, 0x9, 0x10}, {0x0, 0x100, 0x0, 0xe, 0x200, 0x2}, {0x0, 0x0, 0x68, 0xc860, 0x0, 0xfffffffb}, {0x7, 0x8, 0x8, 0x4, 0x9, 0x6}, {0x9, 0x8, 0x5298, 0xffffffff, 0x7, 0xd7}, {0x8000, 0x0, 0x68b, 0x3, 0x0, 0x10001}, {0x7, 0x4, 0x354, 0x3, 0x7, 0x8}, {0xdc09, 0x1ff, 0x2900, 0x193, 0x8, 0x6fd}, {0x6, 0x0, 0xfffffff9, 0x6, 0x9, 0xa2b}, {0xa13, 0x6cdf0f6a, 0xfffffffe, 0x3, 0x3ff, 0x3}, {0x0, 0x9, 0x9, 0x7fff, 0xfffffff7, 0xa4c5}, {0x0, 0x400, 0x2, 0xffffffff, 0x9, 0x9}, {0xb, 0x9, 0x6, 0xb, 0x9, 0xfffffffb}, {0x1, 0x1, 0x7, 0xf, 0x9}, {0x80000001, 0x8, 0x8, 0x8, 0x5e, 0x283}, {0x1, 0x2, 0x5, 0x1, 0x1e, 0xa2fb}, {0x9, 0x35a0, 0x70c, 0x61, 0x7, 0x80000000}, {0x7fffffff, 0x8, 0x4, 0x1, 0x8, 0xdc02}, {0x1000, 0x1, 0xffff8000, 0x8000, 0x934e, 0x1000}, {0x6, 0x100, 0xff, 0x9d22, 0x7, 0x8}, {0x40, 0x6, 0x10, 0x9, 0x1, 0x8}, {0x5, 0xf, 0x0, 0x5, 0x7, 0x4}, {0x4, 0x6, 0x5, 0x7, 0x0, 0x1}, {0x8e, 0x1000, 0xfffffff2, 0xba4, 0x7, 0xd62}, {0x6, 0xe2a2, 0x7, 0x9, 0xb, 0x401}, {0xfffffffe, 0x1, 0xab, 0x6, 0x7, 0x5}, {0x7, 0xffff, 0x15, 0x8, 0x0, 0x7}, {0xff, 0xa20e, 0x9, 0x9, 0x9, 0x1}, {0x14, 0x80000000, 0x8, 0x400, 0xfffffff9, 0x100}, {0x9, 0x7ff, 0x7, 0xf483, 0x2, 0x80}, {0x1, 0x1, 0x5, 0x7, 0x7fff, 0x7}, {0x6, 0x6, 0x3, 0x4, 0xfffffffc, 0x4}, {0xffff, 0x4, 0x7ea, 0x7, 0x3, 0xfffffffb}, {0x5, 0xd, 0x7fff, 0x1, 0x8, 0x1}, {0x0, 0x3a2b, 0x9, 0x1, 0x3, 0x800}, {0x3, 0x4, 0x810, 0x401, 0x1, 0x4}, {0x80000000, 0xd52, 0x5, 0x0, 0x7, 0x6}, {0x40, 0x800, 0x200, 0x0, 0x7, 0x4}, {0x4, 0x9, 0x3, 0x7fff, 0x401, 0x8}, {0x404, 0x6, 0x2, 0x37, 0x8, 0xc}, {0x4, 0x4, 0x2, 0x100, 0xa0000, 0xf}, {0xffff, 0x5, 0x3, 0x0, 0x52a, 0x2}, {0x6, 0x4, 0x8, 0x8, 0x7ff, 0x1}, {0x3ff, 0x6, 0x2, 0x8000, 0x40, 0x7fff}, {0xfffffffd, 0x0, 0x6, 0x5, 0x80, 0x9}, {0x8, 0x0, 0x1, 0x6, 0x6aa, 0x400}, {0xfffffff9, 0xf, 0xc03, 0x7b, 0x0, 0x800}, {0x3ce, 0x9, 0x9, 0xfffffff8, 0x8, 0xfffffff9}, {0xa, 0x10, 0x9, 0xff, 0x4, 0x5}, {0x8, 0x1, 0x2, 0x9d, 0x0, 0x2}, {0x2, 0xde, 0xf74a, 0x1, 0x4, 0xaf}, {0x1, 0x3, 0x2, 0x3, 0x8a}, {0x4eb, 0x1, 0x400, 0x6, 0x8, 0x5ea}, {0x9, 0x0, 0xd, 0x5, 0xfffffbff, 0x6}, {0x9, 0x43, 0xee5, 0x19, 0x7, 0xa0e}, {0x0, 0x3, 0x80000001, 0x493, 0x2, 0x3}, {0x6, 0x8, 0x5, 0x5, 0x5, 0x1}, {0xfffff10a, 0xa47, 0x8, 0x8, 0x7, 0x3ff}, {0x71af, 0xfffffff2, 0x9, 0x80000001, 0x1, 0x2}, {0x7, 0xfffffffa, 0x8, 0x6fc, 0xfffffff8, 0x6}, {0x100, 0xfffffffa, 0x3, 0x7fffffff, 0xfffffeff, 0x48}, {0x3, 0xc05, 0xa, 0x7, 0x2, 0x2}, {0x7, 0x400, 0xe60, 0x9, 0x7, 0xffff}, {0x8, 0x1, 0x7ff, 0x3ff, 0x2, 0x43}, {0xf, 0x1, 0x1, 0xff, 0x2, 0x5}, {0x6, 0x10001, 0xad2, 0x3, 0x5, 0x3ff}, {0x7fff, 0x5, 0x4, 0x4, 0x2, 0xe520}, {0x8, 0xce, 0x2, 0x401, 0x5, 0x4}, {0x7fff, 0xfff, 0x10, 0x3, 0x0, 0x8659}, {0x2, 0x28, 0x7ff, 0x1, 0xfffffffd, 0x5}, {0x5, 0x1, 0x7, 0x9, 0x7, 0x8}, {0x4, 0xf, 0x7, 0x7, 0x76, 0xe}, {0x1ff, 0x4, 0x3, 0x1, 0x39d0d10e, 0x2}], [{0x4, 0x1}, {}, {0x4, 0x1}, {0x3, 0x1}, {}, {0x4, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2}, {}, {0x2}, {0x5, 0x1}, {0x3, 0x1}, {0x3}, {0x1, 0x1}, {0x4, 0x35ce9b60c19f2eff}, {0x5}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x3, 0x1}, {0x2}, {0x3}, {0xb}, {0x4}, {0x4, 0x1}, {0x4, 0x1}, {0x3}, {0x0, 0x1}, {0x1}, {0x5}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x4, 0x1}, {0x4}, {0x1}, {0x5}, {0x3}, {0x1, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x3}, {0x1, 0x1}, {0x3}, {0x4, 0x1}, {0x7, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x4}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x3}, {0x0, 0x1}, {0x1}, {0x0, 0x1}, {0x2}, {0x1}, {0x5}, {0x3}, {0x3}, {0x5}, {0x2}, {0x4, 0x1}, {}, {0x96708bb5e94ea780}, {0x3, 0x1}, {0x3, 0x1}, {0x3}, {0x1}, {0x2}, {0x2}, {}, {0x4, 0x1}, {0x2}, {0x2, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x2}, {0x3}, {0x4}, {0x4}, {0x6}, {0x4}, {0x4, 0x1}, {0x6ce8b82114d8852a, 0x1}, {0x6}, {0x1, 0x1}, {0x2}, {0x1}, {}, {0x5, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {}, {0x4, 0x1}, {0x1, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x2}, {0x3}, {0x0, 0x1}, {0x3}, {0x4}, {0x1}, {0x1, 0x1}]}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 45.576788ms ago: executing program 3 (id=70): syz_emit_ethernet(0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200402, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000480)={'ip6gre0\x00', &(0x7f0000000400)={'ip6gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty, 0x700, 0x20}}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'wlan1\x00', 0x1000}) 45.444348ms ago: executing program 1 (id=71): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {0x0, 0xfff1}, {0x0, 0xc00}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 45.344368ms ago: executing program 3 (id=72): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x20a, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x3}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x24000080) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0x9}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x800) sendto$packet(r0, &(0x7f00000002c0)="05031400d3fc1c0000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.17991ms ago: executing program 1 (id=73): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x0, 0x600}}, 0x10) 1.01832ms ago: executing program 1 (id=74): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70b529, 0x25dfdbfe, {0x7, 0x0, 0x0, r1, 0x80, 0x52, 0x6}, [@NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}]}, 0x28}, 0x1, 0x0, 0x0, 0x240408d4}, 0x40) 897.87µs ago: executing program 1 (id=75): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x304}, "bd88818314ff7d84", "877dab43c700", '\x00', "0100"}, 0x28) setsockopt$inet6_tcp_TLS_RX(r0, 0x11a, 0x2, &(0x7f0000000140)=@gcm_128={{0x304}, "ff1a0636d779eea4", "5e7067dcb7e2ffa7aa84b0566d971cfd", "2d1197d8", "fa8042b72c9ae9ff"}, 0x28) 0s ago: executing program 1 (id=76): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newlink={0x2c, 0x10, 0x401, 0xfffffffc, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x1505, 0x4}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000010) 0s ago: executing program 3 (id=79): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x8ba4, 0xffffffffffffffff, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.44' (ED25519) to the list of known hosts. [ 21.885230][ T24] audit: type=1400 audit(1782089532.020:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.886216][ T271] cgroup: Unknown subsys name 'net' [ 21.907876][ T24] audit: type=1400 audit(1782089532.020:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.935135][ T24] audit: type=1400 audit(1782089532.050:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.935296][ T271] cgroup: Unknown subsys name 'devices' [ 22.050834][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.056415][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.173294][ T24] audit: type=1400 audit(1782089532.310:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.196464][ T24] audit: type=1400 audit(1782089532.310:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.213421][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.221164][ T24] audit: type=1400 audit(1782089532.310:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.252795][ T24] audit: type=1400 audit(1782089532.370:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.278597][ T24] audit: type=1400 audit(1782089532.370:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.313264][ T24] audit: type=1400 audit(1782089532.450:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.338910][ T24] audit: type=1400 audit(1782089532.450:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.338919][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.815090][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.822165][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.829712][ T279] device bridge_slave_0 entered promiscuous mode [ 22.837596][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.844793][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.852274][ T279] device bridge_slave_1 entered promiscuous mode [ 22.920270][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.927307][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.934613][ T280] device bridge_slave_0 entered promiscuous mode [ 22.945151][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.952272][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.959593][ T283] device bridge_slave_0 entered promiscuous mode [ 22.967717][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.974794][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.982070][ T283] device bridge_slave_1 entered promiscuous mode [ 22.992121][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.999144][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.006451][ T280] device bridge_slave_1 entered promiscuous mode [ 23.038179][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.045341][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.052671][ T282] device bridge_slave_0 entered promiscuous mode [ 23.061886][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.068904][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.076299][ T282] device bridge_slave_1 entered promiscuous mode [ 23.145349][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.152532][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.159911][ T281] device bridge_slave_0 entered promiscuous mode [ 23.169322][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.176477][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.183844][ T281] device bridge_slave_1 entered promiscuous mode [ 23.269860][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.276895][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.284183][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.291198][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.300347][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.307371][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.314622][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.321637][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.329931][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.336951][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.344199][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.351219][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.366108][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.373148][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.380505][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.387525][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.417261][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.424308][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.431564][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.438568][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.452821][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.460310][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.467420][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.475074][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.482619][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.489797][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.496946][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.504279][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.511495][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.518690][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.526146][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.543812][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.551348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.559486][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.566493][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.574331][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.582443][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.589471][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.603792][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.611203][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.618520][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.626499][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.634666][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.642818][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.649839][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.670171][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.677644][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.685796][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.692829][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.700682][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.708750][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.715773][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.723211][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.731345][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.738339][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.745682][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.753782][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.760811][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.768098][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.801636][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.810682][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.819422][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.833963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.842540][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.850791][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.857800][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.865774][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.873705][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.881745][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.889636][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.897490][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.909741][ T280] device veth0_vlan entered promiscuous mode [ 23.919065][ T279] device veth0_vlan entered promiscuous mode [ 23.925265][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.933569][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.941713][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.948710][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.956141][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.963964][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.971878][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.980181][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.988232][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.995250][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.002679][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.010497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.018300][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.026566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.036903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.044354][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.051676][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.058996][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.071098][ T282] device veth0_vlan entered promiscuous mode [ 24.085816][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.093713][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.101663][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.110084][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.118079][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.126220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.134715][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.142221][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.150925][ T279] device veth1_macvtap entered promiscuous mode [ 24.161659][ T281] device veth0_vlan entered promiscuous mode [ 24.170069][ T280] device veth1_macvtap entered promiscuous mode [ 24.180354][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.187924][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.196678][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.205038][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.213179][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.221432][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.229846][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.237899][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.246087][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.253734][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.262009][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.270468][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.278616][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.286984][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.294418][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.301986][ T282] device veth1_macvtap entered promiscuous mode [ 24.316820][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.324403][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.332805][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.340867][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.348995][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.357483][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.365929][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.374296][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.382460][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.396279][ T280] request_module fs-gadgetfs succeeded, but still no fs? [ 24.408303][ T280] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.408468][ T281] device veth1_macvtap entered promiscuous mode [ 24.430988][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.440157][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.440376][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.444888][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.445056][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.457478][ T283] device veth0_vlan entered promiscuous mode [ 24.458320][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.458495][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.470553][ T283] device veth1_macvtap entered promiscuous mode [ 24.471526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.473332][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.473549][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.473723][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.473910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.520730][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.577938][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.586569][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.595063][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.595900][ T309] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 24.616773][ T309] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 24.629282][ T309] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2799: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 24.641064][ T313] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 24.642510][ T309] EXT4-fs (loop3): 1 truncate cleaned up [ 24.690100][ T313] EXT4-fs error (device loop4): ext4_orphan_get:1427: comm syz.4.5: bad orphan inode 131083 [ 24.706920][ T309] EXT4-fs (loop3): mounted filesystem without journal. Opts: bsddf,errors=continue,sb=0x000000000000ffff,debug_want_extra_isize=0x0000000000000080,block_validity,noload,,errors=continue [ 24.725870][ T313] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 24.751417][ T314] overlayfs: failed to resolve './cgroup': -2 [ 24.757865][ T313] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 24.773782][ T313] overlayfs: failed to resolve './cgroup': -2 [ 24.872757][ T327] capability: warning: `syz.4.6' uses deprecated v2 capabilities in a way that may be insecure [ 24.886319][ T328] cgroup: fork rejected by pids controller in /syz4 [ 24.964980][ T371] FAT-fs (loop3): Directory bread(block 64) failed [ 24.991933][ T371] FAT-fs (loop3): Directory bread(block 65) failed [ 24.998704][ T371] FAT-fs (loop3): Directory bread(block 66) failed [ 25.006015][ T371] FAT-fs (loop3): Directory bread(block 67) failed [ 25.044385][ T371] FAT-fs (loop3): Directory bread(block 68) failed [ 25.059554][ T371] FAT-fs (loop3): Directory bread(block 69) failed [ 25.066330][ T371] FAT-fs (loop3): Directory bread(block 70) failed [ 25.098170][ T371] FAT-fs (loop3): Directory bread(block 71) failed [ 25.106290][ T412] Zero length message leads to an empty skb [ 25.116357][ T371] FAT-fs (loop3): Directory bread(block 72) failed [ 25.139025][ T371] FAT-fs (loop3): Directory bread(block 73) failed [ 25.199544][ T300] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.315790][ T448] tipc: Started in network mode [ 25.329418][ T448] tipc: Own node identity caec224f2f69, cluster identity 4711 [ 25.337073][ T448] tipc: Enabled bearer , priority 0 [ 25.361776][ T448] device syzkaller0 entered promiscuous mode [ 25.383856][ T447] tipc: Resetting bearer [ 25.407769][ T447] tipc: Disabling bearer [ 25.439502][ T300] usb 5-1: Using ep0 maxpacket: 16 [ 25.569590][ T300] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.601379][ T503] sock: sock_set_timeout: `syz.1.54' (pid 503) tries to set negative timeout [ 25.669931][ T519] device syzkaller0 entered promiscuous mode [ 25.759530][ T300] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.774724][ T300] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.787265][ T300] usb 5-1: Product: syz [ 25.796593][ T300] usb 5-1: Manufacturer: syz [ 25.801463][ T542] device syzkaller0 entered promiscuous mode [ 25.811279][ T549] tipc: Started in network mode [ 25.812105][ T300] usb 5-1: SerialNumber: syz [ 25.816267][ T549] tipc: Own node identity c2a3b2b57062, cluster identity 4711 [ 25.829201][ T549] tipc: Enabled bearer , priority 0 [ 25.839276][ T549] device syzkaller0 entered promiscuous mode [ 25.846558][ T549] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 25.857473][ T549] tipc: Resetting bearer [ 25.864391][ T548] tipc: Resetting bearer [ 25.873328][ T548] tipc: Disabling bearer [ 25.891082][ T553] ================================================================== [ 25.899191][ T553] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x875/0x3330 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 25.907320][ T553] Read of size 8 at addr ffff888114704cc0 by task syz.3.79/553 [ 25.914838][ T553] [ 25.917179][ T553] CPU: 1 PID: 553 Comm: syz.3.79 Not tainted syzkaller #0 [ 25.924347][ T553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 25.934400][ T553] Call Trace: [ 25.937691][ T553] __dump_stack+0x21/0x24 [ 25.942026][ T553] dump_stack_lvl+0x1a7/0x208 [ 25.946691][ T553] ? show_regs_print_info+0x18/0x18 [ 25.951875][ T553] ? thaw_kernel_threads+0x220/0x220 [ 25.957166][ T553] print_address_description+0x7f/0x2c0 [ 25.962718][ T553] ? tc_setup_flow_action+0x875/0x3330 [ 25.968270][ T553] kasan_report+0x100/0x140 [ 25.972773][ T553] ? flow_action_cookie_create+0x28/0x90 [ 25.978403][ T553] ? tc_setup_flow_action+0x875/0x3330 [ 25.983949][ T553] __asan_report_load8_noabort+0x14/0x20 [ 25.989589][ T553] tc_setup_flow_action+0x875/0x3330 [ 25.994877][ T553] ? __kmalloc+0x19f/0x330 [ 25.999298][ T553] ? tcf_exts_num_actions+0x28b/0x2b0 [ 26.004649][ T553] mall_replace_hw_filter+0x2db/0x8c0 [ 26.010002][ T553] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 26.016046][ T553] ? mall_set_parms+0x450/0x450 [ 26.020872][ T553] ? tcf_exts_destroy+0xb0/0xb0 [ 26.026049][ T553] ? pcpu_alloc+0xf8d/0x16c0 [ 26.030621][ T553] ? mall_set_parms+0x1a0/0x450 [ 26.035452][ T553] mall_change+0x546/0x770 [ 26.039852][ T553] ? __kasan_check_write+0x14/0x20 [ 26.044941][ T553] ? mall_get+0xa0/0xa0 [ 26.049081][ T553] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 26.055132][ T553] tc_new_tfilter+0x1487/0x1ab0 [ 26.059961][ T553] ? mall_get+0xa0/0xa0 [ 26.064101][ T553] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.069710][ T553] ? security_capable+0x87/0xb0 [ 26.074539][ T553] ? ns_capable+0x8c/0xf0 [ 26.078847][ T553] ? netlink_net_capable+0x125/0x160 [ 26.084111][ T553] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.089728][ T553] rtnetlink_rcv_msg+0x811/0xca0 [ 26.094662][ T553] ? unwind_get_return_address+0x4d/0x90 [ 26.100272][ T553] ? rtnetlink_bind+0x80/0x80 [ 26.104928][ T553] ? stack_trace_save+0xa6/0xf0 [ 26.109755][ T553] ? stack_trace_snprint+0xe0/0xe0 [ 26.114843][ T553] ? avc_has_perm+0x168/0x3d0 [ 26.119496][ T553] ? memcpy+0x56/0x70 [ 26.123456][ T553] ? avc_has_perm+0x27f/0x3d0 [ 26.128115][ T553] ? __kasan_slab_alloc+0xc9/0xe0 [ 26.133115][ T553] ? avc_has_perm_noaudit+0x260/0x260 [ 26.138551][ T553] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.144598][ T553] ? selinux_nlmsg_lookup+0x398/0x430 [ 26.149991][ T553] netlink_rcv_skb+0x1e9/0x430 [ 26.154735][ T553] ? rtnetlink_bind+0x80/0x80 [ 26.159389][ T553] ? netlink_ack+0xb30/0xb30 [ 26.163953][ T553] ? __netlink_lookup+0x387/0x3b0 [ 26.168958][ T553] rtnetlink_rcv+0x1c/0x20 [ 26.173352][ T553] netlink_unicast+0x86c/0xa30 [ 26.178092][ T553] netlink_sendmsg+0x949/0xb70 [ 26.182832][ T553] ? netlink_getsockopt+0x530/0x530 [ 26.188005][ T553] ? security_socket_sendmsg+0x82/0xa0 [ 26.193445][ T553] ? netlink_getsockopt+0x530/0x530 [ 26.198623][ T553] ____sys_sendmsg+0x5be/0x8f0 [ 26.203402][ T553] ? __sys_sendmsg_sock+0x40/0x40 [ 26.208404][ T553] ? import_iovec+0x7c/0xb0 [ 26.212882][ T553] ___sys_sendmsg+0x236/0x2e0 [ 26.217535][ T553] ? __sys_sendmsg+0x280/0x280 [ 26.222276][ T553] ? alloc_file+0x82/0x580 [ 26.226670][ T553] ? __fdget+0x1a1/0x230 [ 26.230894][ T553] __x64_sys_sendmsg+0x201/0x2d0 [ 26.235810][ T553] ? __kasan_check_write+0x14/0x20 [ 26.240897][ T553] ? ___sys_sendmsg+0x2e0/0x2e0 [ 26.245744][ T553] ? __kasan_check_read+0x11/0x20 [ 26.250853][ T553] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 26.256464][ T553] do_syscall_64+0x31/0x40 [ 26.260864][ T553] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.266735][ T553] RIP: 0033:0x7fd31406ee59 [ 26.271134][ T553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.290720][ T553] RSP: 002b:00007fd312ac9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.299223][ T553] RAX: ffffffffffffffda RBX: 00007fd3142e7fa0 RCX: 00007fd31406ee59 [ 26.307215][ T553] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 26.315166][ T553] RBP: 00007fd314104e6f R08: 0000000000000000 R09: 0000000000000000 [ 26.323115][ T553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.331062][ T553] R13: 00007fd3142e8038 R14: 00007fd3142e7fa0 R15: 00007fff491f1998 [ 26.339043][ T553] [ 26.341351][ T553] Allocated by task 553: [ 26.345576][ T553] __kasan_kmalloc+0xd4/0x100 [ 26.350235][ T553] __kmalloc+0x19f/0x330 [ 26.354542][ T553] tcf_idr_create+0x5f/0x790 [ 26.359127][ T553] tcf_idr_create_from_flags+0x61/0x70 [ 26.364559][ T553] tcf_gact_init+0x2e6/0x560 [ 26.369122][ T553] tcf_action_init_1+0x443/0x6d0 [ 26.374035][ T553] tcf_action_init+0x227/0x780 [ 26.378806][ T553] tcf_exts_validate+0x23c/0x540 [ 26.383721][ T553] mall_set_parms+0x4a/0x450 [ 26.388285][ T553] mall_change+0x47a/0x770 [ 26.392678][ T553] tc_new_tfilter+0x1487/0x1ab0 [ 26.397504][ T553] rtnetlink_rcv_msg+0x811/0xca0 [ 26.402414][ T553] netlink_rcv_skb+0x1e9/0x430 [ 26.407151][ T553] rtnetlink_rcv+0x1c/0x20 [ 26.411543][ T553] netlink_unicast+0x86c/0xa30 [ 26.416389][ T553] netlink_sendmsg+0x949/0xb70 [ 26.421125][ T553] ____sys_sendmsg+0x5be/0x8f0 [ 26.425952][ T553] ___sys_sendmsg+0x236/0x2e0 [ 26.430607][ T553] __x64_sys_sendmsg+0x201/0x2d0 [ 26.435525][ T553] do_syscall_64+0x31/0x40 [ 26.439926][ T553] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.445789][ T553] [ 26.448097][ T553] The buggy address belongs to the object at ffff888114704c00 [ 26.448097][ T553] which belongs to the cache kmalloc-192 of size 192 [ 26.462129][ T553] The buggy address is located 0 bytes to the right of [ 26.462129][ T553] 192-byte region [ffff888114704c00, ffff888114704cc0) [ 26.475731][ T553] The buggy address belongs to the page: [ 26.481358][ T553] page:ffffea000451c100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114704 [ 26.491581][ T553] flags: 0x4000000000000200(slab) [ 26.496585][ T553] raw: 4000000000000200 ffffea000451c000 0000000600000006 ffff888100043380 [ 26.505146][ T553] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.513872][ T553] page dumped because: kasan: bad access detected [ 26.520254][ T553] page_owner tracks the page as allocated [ 26.525950][ T553] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 101, ts 4233237571, free_ts 4233191964 [ 26.541733][ T553] prep_new_page+0x176/0x190 [ 26.546297][ T553] get_page_from_freelist+0x225f/0x23f0 [ 26.551819][ T553] __alloc_pages_nodemask+0x29a/0x640 [ 26.557163][ T553] new_slab+0x84/0x3f0 [ 26.561224][ T553] ___slab_alloc+0x2f8/0x4c0 [ 26.565801][ T553] __slab_alloc+0x63/0xa0 [ 26.570108][ T553] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 26.575463][ T553] kernfs_fop_open+0x375/0xbb0 [ 26.580209][ T553] do_dentry_open+0x7a5/0x10a0 [ 26.584951][ T553] vfs_open+0x73/0x80 [ 26.588910][ T553] path_openat+0x26c3/0x3040 [ 26.593479][ T553] do_filp_open+0x1df/0x400 [ 26.597959][ T553] do_sys_openat2+0x19f/0x750 [ 26.602611][ T553] __x64_sys_openat+0x136/0x160 [ 26.607446][ T553] do_syscall_64+0x31/0x40 [ 26.611838][ T553] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.617701][ T553] page last free stack trace: [ 26.622356][ T553] free_unref_page_prepare+0x2b7/0x2d0 [ 26.627789][ T553] __free_pages+0x146/0x390 [ 26.632265][ T553] free_pages+0x82/0x90 [ 26.636408][ T553] selinux_genfs_get_sid+0x20b/0x250 [ 26.641680][ T553] inode_doinit_with_dentry+0x879/0xd70 [ 26.647204][ T553] selinux_d_instantiate+0x27/0x40 [ 26.652292][ T553] security_d_instantiate+0x9e/0xf0 [ 26.657467][ T553] d_splice_alias+0x6d/0x390 [ 26.662035][ T553] kernfs_iop_lookup+0x2c5/0x310 [ 26.666948][ T553] __lookup_slow+0x2b8/0x410 [ 26.671511][ T553] lookup_slow+0x57/0x70 [ 26.675732][ T553] walk_component+0x326/0x460 [ 26.680391][ T553] path_lookupat+0x155/0x430 [ 26.684956][ T553] filename_lookup+0x1fd/0x660 [ 26.689706][ T553] user_path_at_empty+0x43/0x50 [ 26.694536][ T553] vfs_statx+0x10a/0x530 [ 26.698751][ T553] [ 26.701068][ T553] Memory state around the buggy address: [ 26.706680][ T553] ffff888114704b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.714731][ T553] ffff888114704c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.722770][ T553] >ffff888114704c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.730807][ T553] ^ [ 26.736942][ T553] ffff888114704d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.744979][ T553] ffff888114704d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.753027][ T553] ================================================================== [ 26.761069][ T553] Disabling lock debugging due to kernel taint [ 26.959476][ T300] cdc_ncm 5-1:1.0: bind() failure [ 26.965391][ T300] cdc_ncm 5-1:1.1: bind() failure [ 26.976477][ T300] usb 5-1: USB disconnect, device number 2 [ 27.689915][ T9] device bridge_slave_1 left promiscuous mode [ 27.696172][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.703801][ T9] device bridge_slave_0 left promiscuous mode [ 27.710056][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.717654][ T9] device veth1_macvtap left promiscuous mode [ 27.723692][ T9] device veth0_vlan left promiscuous mode [ 28.120721][ T9] tipc: Left network mode [ 28.125129][ T9] tipc: Left network mode [ 28.809984][ T9] device bridge_slave_1 left promiscuous mode [ 28.816178][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.823541][ T9] device bridge_slave_0 left promiscuous mode [ 28.829680][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.837171][ T9] device bridge_slave_1 left promiscuous mode [ 28.843340][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.850652][ T9] device bridge_slave_0 left promiscuous mode [ 28.856729][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.864497][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.871765][ T9] device bridge_slave_0 left promiscuous mode [ 28.877926][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.885547][ T9] device bridge_slave_1 left promiscuous mode [ 28.891835][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.899076][ T9] device bridge_slave_0 left promiscuous mode [ 28.905311][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.913243][ T9] device veth1_macvtap left promiscuous mode [ 28.919299][ T9] device veth0_vlan left promiscuous mode [ 28.925240][ T9] device veth1_macvtap left promiscuous mode [ 28.931260][ T9] device veth0_vlan left promiscuous mode [ 28.937118][ T9] device veth1_macvtap left promiscuous mode [ 28.943153][ T9] device veth0_vlan left promiscuous mode [ 28.948938][ T9] device veth1_macvtap left promiscuous mode [ 28.955052][ T9] device veth0_vlan left promiscuous mode