last executing test programs: 918.745632ms ago: executing program 4 (id=5): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x4, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x4, 0xfff2}, {}, {0x3, 0xfff1}}}, 0x24}}, 0x40004) 836.124895ms ago: executing program 4 (id=12): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='cdg', 0x3) sendmmsg$inet(r0, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f00000001c0)="56a1bff0a116583852a548f8efefa40509043cdf09d06f3a7b08dd57d2aa58349b19bc8121713da0385242aa3472c8c524ba4bc3f315350729dade83ba49b8c1c68955", 0x43}, {&(0x7f0000000700)="0262d1f349a8b8b8b3450f0d00e1c8d59c324d4e5e54a9adef6a550e46bd9bd96ff7ef2aa0860be570ac1f8c0731f40ddf04e7c2520984e47bbd685cc7e24a627103086ea81caca306bf61d5484d78fa03bcd70e6eec9cc55ec06bf3db616e0a0e9f11a82b6ef4304031310e9c46c0771d031f1c7e30d81c6d2791ba2fa30c3141736fb66d1de45f30b425da080b5c38bfc0cf758502ca3e", 0x98}], 0x2}}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000880)="d0f546879b1c8197581fa251c00264e8866a2fbe4b94d482482255aa98ce8e4a6195447a8500714b35cf0eaa9ffe6bb5713b60ce06b8f9afdfa38af5d63b5a49a40f9e6abdb35f35843162aea9e7972ec7db5c", 0x53}, {&(0x7f0000000900)="6cd059070b690e4581486d6a23efc0130a035df230fd950bc449e212285fdee60868a611a98ccfa99a56a8d358365ebf2d4bfd3cea9887f7cbbc7c775421ed83f45ba52f7be08ee009678e8c1c05f4df7abf209d9b3fd8dd4aeb4c8d0fc9d3", 0x5f}, {&(0x7f0000000a40)="1ab7e2aa7b59d3ddf28e70bdb57793e3c01daaed817548b479c5caeee9946f3658d701e62962a0552ac4d41b71f22de834a134044aa312583b8e38d356c579e41714394a1f4ec0f61f0a881f53dd4049d08e40b1521db45a9cf1c175096f70c603aec062426219bd21d91077b73b84798851269289a19ffe84dd9e21d257abca80d1e9cb2cc06fa855aa8da2793a2ac174035dd5b9", 0x95}], 0x3}}], 0x3, 0x4000000) 809.683235ms ago: executing program 1 (id=13): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='H\x00\x00\x00\n'], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 809.467065ms ago: executing program 4 (id=14): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x1c, 0x3b00, 0x0, 0xfffffffffffffdfd) 809.324515ms ago: executing program 1 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000300)={0x78, r1, 0x121, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0xff]}, @NL80211_ATTR_FRAME={0x51, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x8}, @device_b, @broadcast, @from_mac=@device_b, {0x7, 0x26}}, 0xd921, @default, 0x100, @void, @val, @void, @val={0x4, 0x6, {0x0, 0x7, 0x9, 0x5}}, @void, @val={0x5, 0x3, {0x1, 0xe9}}, @void, @val={0x2a, 0x1, {0x1}}, @val={0x3c, 0x4, {0x0, 0x2, 0x99, 0x3}}, @void, @void, @val={0x71, 0x7, {0x1, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0x4e, 0x40}}, @val={0x76, 0x6, {0x5, 0x3, 0x6, 0x7fff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x30) 776.100056ms ago: executing program 1 (id=17): r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, 0x0}, 0xa}], 0x1, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x8000) getsockname$packet(r3, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000000) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x48, &(0x7f0000000d40)={@link_local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "019701", 0x12, 0x11, 0x0, @private1, @mcast2, {[], {0x0, 0xe22, 0x12, 0x0, @gue={{0x2}, 'J?'}}}}}}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$tipc(r1, 0x0, 0x48004) 775.965847ms ago: executing program 4 (id=18): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000500)="cd", 0x1}], 0x1}}], 0x1, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 713.498448ms ago: executing program 1 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="8100000092a480288bc67a83000008000300", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x24000800}, 0x20000000) 655.71093ms ago: executing program 1 (id=32): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x9, 0x4}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_EMATCHES={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000500)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f3beeab215672d4240e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f29104cb902efbd7822f111709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b4980c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570744eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe0481325f69ae0f2ea77372d8be6b991c8b6a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae16e0ffec4b30496d012fa00958f794cdbd73595026704f03f532796529d1fc3489415fcfcc35f8eec7136746e6435469be583bb3c57400804a7f9ea9735b03d593028fe003e1e2969245410a32876bb706eaf9c37a468a8c53b22e884382ad6e45b217604ca18c1f648f484769ea131a7828706762fd27c12cc6ba3300ae0944cf2e0366fbef7426201528bb4cdc10f0a6837431390a37825f348edb4d98d75a99a", 0x248, 0x4000, 0x0, 0x0) close(r2) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="21000000000000002a0012800b00010067656e65766500000c00028008001100ff"], 0x50}}, 0x8000) 655.49376ms ago: executing program 1 (id=34): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x53, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r0) recvmmsg(r0, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0x8004}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001500)=""/4112, 0x1010}, {&(0x7f0000000180)=""/82, 0x52}, {&(0x7f0000000040)=""/212, 0xd4}], 0x3}, 0x400000}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x800}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}], 0x7, 0x60020000, 0x0) 298.330031ms ago: executing program 2 (id=72): socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r0, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xdaf, &(0x7f0000000a40)={@local, @random="991d32511a2a", @void, {@mpls_uc={0x8847, {[], @ipv4=@dccp={{0x6, 0x4, 0x0, 0x0, 0xda1, 0x68, 0x0, 0x38, 0x21, 0x0, @private=0xa010102, @multicast2, {[@rr={0x7, 0x3, 0x3b}]}}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xd, 0x0, 0x0, 0x4, 0x5, "c50f7c", 0x2, "6d9bef"}, "f041ef4265f64c61e6b4dfbad02ca95aeb25f8591ea18476f2946cf87cf36257475b8c33af71d98938f850c051014fc51f817fdaeb0238f77f9e4f485718adef2c6a6bd60797d0c5b6f283d02e2f85644f18c9e3ac626d9b9e11461e170193ca0a2c83ddaf42a294218853a56fc80982d65e282d4c6734ec5dc546f028dafe8697468479c5f016b7384f337b2e6dfc0575d40ac7cfd2da6fcfd5964b653e6bf053c3d9c30f67d08ebb53c7e88d4bf70ac624914d8010cdd767dc13d2d2007faac18690efd2077f56cc69b25f397a6d13b8f2f9f6bfd0ecc44f4c42f1ac35c4e5020c612e7bbe89a9f3ca18b6748662a5caf44d86eac0f480b5e2fb614007e787c3a852cb86658c77653e2596f945e6b7b5d4a44f16a3f1d459e60ca4a31f5982400b4a1b9e03e740fb87760dc431a00352442d149c3825032262e23ed170a4f4dd77819b141dc777335527d46dd4d50a362cb08fb9a7eb6697447f0166ed53b098c178fe941e79588495861f71aad7380a7a3025c9d601ce4b4f023395829d3e4d1c48893f494736c2cac110fb87bb9129756ecffb485a829b177644809d27a6b27f78a5ab656e0d2fdf1b2408f9a6390322ca8af5ecb64d7742c8a5d063158bf75b31b9a34c16d250a960e41dc90ecdbbf21c13e83c3e31812d771ce53e0563033c2058f3c31e70fbf97fd251fc22910e43806552b536701c778f7386edadfe6024a699073872cf2892a8737fcce3cae5fcdf90bed56c1512fa46aa0f20a9c0b2cc62bd51ae949b03e90fecd491cd029c29e5ab78fefd67c52ed95f7da8cb46c0692425b74c7deceff32f6eb15563a8b9ecf4b01a9b0f47d833c3c3c48f65c54b256f16860608d11b77ff4f2e0f483fd6911b97a019946cecf18e0312d3011e9396aee097a35f3ac69b105435e547bcbfcdf7338b7841c6d412121928a876e7fc954c7567cb0e11741fe7a573060276bf7b63240718010c1f75fe33269cc3b06586ff7acd9781d7d5cae7386ed9e6ebea20897e20d8387398969989be1c4fa614406be204fff47780b5a9a68ae1437b370d04ef2acd32ee459244e410bded7554e8068fcd2243f2c4e35f1cbf7df87323f27127aad50fdaab3c657b74ff76a45075ecb2973e2c387fc5597f247d3461b3acc2218e3d72e4e745dabc219877d00ffd57616a02a8f031dee54de6e04e953b0eef0ee5accd32cfeb55707598dc26510cb87a15a7137486fecabd08aa461a9af07585ba77db62b8271ca36f8791884b20acb99b875990f363ff5234b2d65362c1ab4a18bca6829ca9d9e1c4dad9243340680b5153ef751cfce67feefdb3ac14ad24061c5232a656f4214d92c7b69a38387af843817186a2a6956fddfdd4ce2b95acc951ce66cc27d8fd7dba0b18340833a9c9c8680efb3d59a795107aad781b820f672b5e818f8ef7f92a44b188f6fbb0b2b05598db61cd61b74ddeb7f6f1971f73fc7c8370ba348c883080d409efcf55ab1473c1a860830b20824482cd32966d89d5eed670ad66f6e23ebe2ae0379ed304b6e4acae6edd67182cb9432a85138f62a916a073c467c0516b3b93deafb9e1a8f746587bf6c5775ed53c5862c223319c764f81bc266ecca8daddb16bf9e6fcaec6334e12df4bc814f1343d892eb131cc24b798ef1fbecdc37dfb00f997bc86e6639795a99575cc178b362882931028f083a7609bc7a8e0bfaa0f53c3fed283c3aa0c25244e1e55444f5dda068d2b53cf1a11d8ed5e7731a9a842de1b6864d976436cb0082d67372c336202c7d80100673541092ee30d5073cf3d8662a90e67f776323a6ff6ae759c6d30462847725fd5bac956a5fad7cb94dee9a1685b78979a4093fd5a45851cc4f70a66c0f30f58d3ccedac3440f71d94df9f9428e17202508dd4e34df0620f9c6c1f02a51744a3c32f83169af401214b28e9a6b97f6e1a1e30cc599237a7c7dd11e8330702a12b0953cd563226322af3d3d5b2fdb33810e334b57bba3cebc84ccc5711131ea6a91d3c04a632fa2526843589ab0d982b089236275f8921fda31baa5d499534a6ac95cc0f65c87880cb3c8c24134ed39fc8a2062abad521c5739dc854566d5def47097d22e887dd763bf8b3d6ef6352add80c6ba16b68e1c17783de5b19317e2910248fff1332a5d64119f10d3c26fb196a0cb889307e4be0f4d061cdf1337756326d14c964e1c5ead0c32f34e7e16080ec57183c3add48a06d3a72dbbe7093f12461eb0ef9c9821d82997e02229bc926b8229b34fba7729a9eb2a4594c0c446381697bec5572dce85b39e11ea8f8a0c8f75318c85e786855b86f29e0e097509fe1169bb33c14c7c330f75ee5f222d7574d407c1475b7b63253ad3856a2e49421c2e5d20b25292032ce060af63749b2f1ab5f01e9b3140f623d533d79b43121278eb2a8d79a23f1e24f0f563e3cf84f164ea3dc258b5b8defdfa078e587d572053c3ff288e7e044ed6e4d7b7ac04f54599e0e3dcc35c7d3a58a2c2cf05f1d148379fcc403918a27af85f47fde54b0ee051074bc24a8a9a872edcc4f198fcf37230aedb31924f8262b9f9fdfb490ef06fb1add7a39eeb3001b2f1f210a3b740db44f0669f02a9855794a157d50f626d46d6767cd9c172631b94ab6fc81cafb9cca8dee63a463dfb5c20e6ef02bbbf61bab5bf89cb65c4c215285c96a2746ef6bff9db11c6f6e595033ea9759cb483c0fe83922aa980e8299e3882701c5a6e531302a1a2d2949b6aed4c6324ccc7f835797714fbab559168b30cf3a260d9c4f8d55b4dae31883a71531ad663de432339f3b46be7e0269d2cbb8bf60f88a463e9a7a20a2713257b18eb7e3b2762be23a0e83e970f46d4223cc0c3a3aa58d8edef6fd77da13e3ff30ecfa2abfb6d8fef8491c15b024248cb288cbca2f52c87389569a9adc8321ed212973ae7af06368636f00c510176eee46be9ac968f43522eedf4d04980062c1cc293b13e2f5106d8d22e5c1baa8d5580c5accfd287096827550e592f667e1cfbdfc72d23bc338a7c61406d646789323aebfa9926f3be15f334d4d1970c201972236f116b5fd5109a76f5757b6ee564cb7fabd6e5d72173bdb2d34492531a36290a01c7d072a2460700cea52c64f29d0bc504c866b8c98d8c3e7d801ed3c102835fee76ab159ce063d1884a8cda34191ecfdcea0d7461d7b83d28152e172bb173196fcaf1d45eaac1d95e8ba9cb7e6ea0ee3e2651b091810765cd068bc7c1a9763569a124531dcd640d0a15c78c3c6f80f92294d67386a091f20d7cebe87bf477d94d7da216e8ec1c2a0a53e76010f7d7a110914275f7839da69ab40b798fe4f33342ce744e2b48576487d5c4264352a9471b36840d3552d81119be285be3a6080bbe0c07c06c446717a60594e1b108a782fea3e22545308dfe91ef38a609c8c4ada5f487224ccd1652e672b94aab1b4983d651137bf38c6165bbf5ec1a718efa13044d2ecae693e1049959b17c148ca934aead27988f41ffc3a99d9b56bb208867f5eba7797488ff36f43d19da3985c498784b0d4d89fbe713db536c43c129be120e865f9a28e598b6b0ca3fc7a813eb0151e23b1e2eccfde4dc002e8c6019d98e2aa15b1e7889c670ecd202371d530229326d53952cd2c6496847b3f91476d0d4040908a4b6b9ea95a66964dc0f19113365437d2acb4cd5b3dc047afa959c00b32f4bc8a5342b3475e521c3525db221b3f6e678cd170927b74bf586f256466168e9b721f18d24e769e264c06a94bece84b861012457a4e9d0b153cdd6f0931b4ecde642f85bcb777e0af2f0bf84fe24be4a3c73da846bab0b332002bf66b7dddd3514807472dc6e8fb1c7a079600244a6d2e6c428230de8ef6db8c03f89105c7061c2696b130ba340210e051498e61c83012cef658f67bdc4188b3949f3bbb933b9e39ae26e1462ec9946c241b88c9959e8e45d711de6a87c0b532d4a0dd12decd92264ed5435cdcc9a087521197bdede56915a14ac04b84400fba5c339a0a2f0afdd72e08580b44e83e511f8122336bdce117d6a8c7ee712aad480909d722270fe5727dbc58d26344f85dfe969368a4ed970fc5a363b90f18c70e984fbd3e78b652b39969a8b1621cd0381c361d73f940dc03ab8922f16e4e6de5d3c5f1c880bf25a87ea1073dee43498b3eecec8342bd0005c4a8be9720232067c80a47821777cbe8aaf12dbd022e107465612000ef903c921c5d75afd784dda23841f680e02a2eab7207c9a259ee4f29a813830935b1453f7be9b90fa452f69a40edd5d83c277984f3c2295ca9446d1c5d4653d3f8f94cd5f9e7ecf8a1ee2755133d0b29f9d9717af3414feeb31c5cccf41d6a715cc9a00cae42f53f9776a255f2041a1d3d4ca0e0adead9b4bac712ac5ef58fe492b3bbd2b0cec6ca48fa1f038d311c03535341dbba6502535a7dcea9c38a478838463397546a8c37202346e12300332c4a4f0249f74d3fcbc7dc38ea806d7fdfd29f8b8b0567960c47e79810c964a42bb439d0674e1628cb4cd5e5bba6c45605ffd5f7f854326e637aaf8af83598adf8b637798b59065b06f67240568da32c63c185df58ba1a83a831c2867f9ac9c8378e8a035baaeeabec4efed0e44c832edecb663a40f0ec5667ad6e2b2d99b14537f5131675c438a031f0548201938fd021bce0eeb62c397dda0fdc459913c9c331a74a41531c27add4f4be682fec136255972745b3fd241fdde48fa95fc58523327779f036bedefd2942a856f39f8066e24d4f1a9639a366b6f6437ba74b9ab1231f31ed69f89214f493dc66441f16fab2a2e29819ec98cf89130fafa349a09d2656cb6c816c98c76800c0aa99f2babd2111b465a493b798c30cd697951d1a78aeead076"}}}}}}, 0x0) 246.621973ms ago: executing program 2 (id=76): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f0000000180)=0x1, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) 246.363103ms ago: executing program 2 (id=78): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000791028000000000069002600000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xa4, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x248, 0x258, 0x258, 0x248, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x2, 0x0, 0x5}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0xfffffffd, 'netbios-ns\x00', 'syz1\x00'}}}, {{@ipv6={@dev, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x378) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000010427bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="014800f81853010014003500626f6e643000000000000000000000001c00128009000100626f6e64000000000c00028008000700b1090000"], 0x50}}, 0x0) 189.280434ms ago: executing program 2 (id=80): socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e23, @multicast1}, 0x10) 109.167987ms ago: executing program 3 (id=85): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f00000000c0)="f461", 0x2, 0x4094, &(0x7f0000000100)={0x2, 0x0, @empty}, 0x10) 108.986507ms ago: executing program 3 (id=86): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048000}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 108.832877ms ago: executing program 3 (id=87): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=@base={0x12, 0x4, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r4, @ANYBLOB="60005080110001004abee339084eeef16f162471f4000000080003000cac0f00050002"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 82.980977ms ago: executing program 0 (id=89): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) 39.147079ms ago: executing program 3 (id=90): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000580)={0x30, 0x7, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x40808) 38.955279ms ago: executing program 0 (id=91): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r2, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c00018005000300"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 38.849909ms ago: executing program 3 (id=92): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x80) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x1c, 0x66, 0x0, 0xf, 0x11, 0x0, @empty, @empty=0xe0000001}, {0x4e24, 0x4e20, 0x8}}}}}, 0x0) 38.757669ms ago: executing program 0 (id=93): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000f80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000fc0)={0x6c, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x18, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="32f57bc3564888ddb832f7ab31c4f0e3"}]}, @NL80211_ATTR_REKEY_DATA={0x4}, @NL80211_ATTR_REKEY_DATA={0x34, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6408dc63b51c06414d8b123633cd58e6e090ee74da1d28672a64fe80cea372bb"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "3da85d34bf0e880f"}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 38.638419ms ago: executing program 2 (id=94): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0x20040084) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x21, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r0 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3f011400dcdc14"], 0xdd12}], 0x1}, 0x200400d1) 694.56µs ago: executing program 3 (id=95): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000480)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x8864, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 381.85µs ago: executing program 0 (id=96): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) getsockopt$inet_buf(r0, 0x0, 0x2f, 0x0, 0x0) connect$inet(r0, &(0x7f0000000440)={0x2, 0x4e24, @remote}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0xac1414bb, @multicast1=0xac14140f}, {0x4e24, 0x4e20, 0x8}}}}}, 0x0) 196.12µs ago: executing program 2 (id=97): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {}, {0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x8ba4, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x84, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x0, 0x0, 0x0, 0x0, {0x0, 0x1, 0x0, 0x0, 0x27}, {0x0, 0x0, 0x0, 0x0, 0xfffd}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x84}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 91.06µs ago: executing program 0 (id=98): connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x300) r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c) socket(0x10, 0x80002, 0x0) recvmmsg$unix(r0, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002123, 0x0) 0s ago: executing program 0 (id=99): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c8, &(0x7f0000000100)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. [ 22.135906][ T24] audit: type=1400 audit(1785120898.129:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.136900][ T271] cgroup: Unknown subsys name 'net' [ 22.158538][ T24] audit: type=1400 audit(1785120898.129:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.185735][ T24] audit: type=1400 audit(1785120898.159:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.185874][ T271] cgroup: Unknown subsys name 'devices' [ 22.297181][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.302756][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.409271][ T24] audit: type=1400 audit(1785120898.399:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.432468][ T24] audit: type=1400 audit(1785120898.399:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.437681][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.457172][ T24] audit: type=1400 audit(1785120898.399:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.488860][ T24] audit: type=1400 audit(1785120898.469:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.514366][ T24] audit: type=1400 audit(1785120898.469:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.546423][ T24] audit: type=1400 audit(1785120898.539:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.571903][ T24] audit: type=1400 audit(1785120898.539:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.597921][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.024896][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.032143][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.039532][ T279] device bridge_slave_0 entered promiscuous mode [ 23.047062][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.054078][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.061533][ T279] device bridge_slave_1 entered promiscuous mode [ 23.158031][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.165073][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.172406][ T280] device bridge_slave_0 entered promiscuous mode [ 23.179333][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.186440][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.193790][ T280] device bridge_slave_1 entered promiscuous mode [ 23.219084][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.226130][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.233455][ T283] device bridge_slave_0 entered promiscuous mode [ 23.255420][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.262524][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.269798][ T283] device bridge_slave_1 entered promiscuous mode [ 23.291368][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.298457][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.305842][ T282] device bridge_slave_0 entered promiscuous mode [ 23.312557][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.319724][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.326981][ T282] device bridge_slave_1 entered promiscuous mode [ 23.350726][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.357794][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.365027][ T281] device bridge_slave_0 entered promiscuous mode [ 23.374024][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.381190][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.388518][ T281] device bridge_slave_1 entered promiscuous mode [ 23.396755][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.403767][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.411036][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.418076][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.529986][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.537046][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.544274][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.551328][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.566132][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.573158][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.580415][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.587437][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.599786][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.606960][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.614037][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.621604][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.628830][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.636024][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.643702][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.651113][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.660910][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.669131][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.676177][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.688144][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.696412][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.703432][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.734177][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.747350][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.767285][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.774735][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.782605][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.790289][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.798477][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.805516][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.812803][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.821083][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.828137][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.835590][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.859719][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.867778][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.876234][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.883247][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.891123][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.899295][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.906315][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.913642][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.921574][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.929484][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.937619][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.944640][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.951962][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.960054][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.967066][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.974341][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.993675][ T279] device veth0_vlan entered promiscuous mode [ 24.000499][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.008967][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.017255][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.024549][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.032383][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.040729][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.048744][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.056108][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.063406][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.071316][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.080658][ T281] device veth0_vlan entered promiscuous mode [ 24.095232][ T282] device veth0_vlan entered promiscuous mode [ 24.104501][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.112896][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.121400][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.128430][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.135832][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.143840][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.151766][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.160022][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.168275][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.176288][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.184101][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.191897][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.199870][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.207252][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.219485][ T279] device veth1_macvtap entered promiscuous mode [ 24.229044][ T281] device veth1_macvtap entered promiscuous mode [ 24.236958][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.245063][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.253160][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.261274][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.269883][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.278166][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.286546][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.294590][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.301622][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.308949][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.317035][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.325035][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.334637][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.342490][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.359976][ T282] device veth1_macvtap entered promiscuous mode [ 24.370292][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.377710][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.385021][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.393064][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.401287][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.410089][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.418332][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.426264][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.434064][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.442598][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.451089][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.459238][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.467349][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.474808][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.483038][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.495229][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.503641][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.514193][ T283] device veth0_vlan entered promiscuous mode [ 24.523521][ T280] device veth0_vlan entered promiscuous mode [ 24.530755][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.538995][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.547352][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.555087][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.563154][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.571406][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.579875][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.587347][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.606368][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 24.607779][ T280] device veth1_macvtap entered promiscuous mode [ 24.621529][ T283] device veth1_macvtap entered promiscuous mode [ 24.628554][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.636836][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.645010][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.653214][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.661391][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.668944][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.677047][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.685359][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.699272][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.717603][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.732907][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.741801][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.750584][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.759311][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.763019][ T307] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=307 comm=syz.1.6 [ 24.767966][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.788014][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.796247][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.819098][ T307] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6'. [ 24.842632][ T313] netlink: 'syz.0.7': attribute type 4 has an invalid length. [ 24.883253][ T315] device syzkaller0 entered promiscuous mode [ 24.894946][ T321] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4'. [ 25.021652][ T349] device bridge1 entered promiscuous mode [ 25.047215][ T356] netlink: 64 bytes leftover after parsing attributes in process `syz.1.25'. [ 25.149269][ T378] netlink: 12 bytes leftover after parsing attributes in process `syz.2.36'. [ 25.160896][ T380] netlink: 'syz.3.37': attribute type 1 has an invalid length. [ 25.185709][ T380] netlink: 'syz.3.37': attribute type 2 has an invalid length. [ 25.193396][ T380] Zero length message leads to an empty skb [ 25.280214][ T399] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=399 comm=syz.2.47 [ 25.434091][ T441] netlink: 16 bytes leftover after parsing attributes in process `syz.0.67'. [ 25.517192][ T464] xt_l2tp: missing protocol rule (udp|l2tpip) [ 25.755829][ T502] ================================================================== [ 25.763956][ T502] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3160 [ 25.772104][ T502] Read of size 8 at addr ffff88810f5808d8 by task syz.2.97/502 [ 25.779634][ T502] [ 25.781977][ T502] CPU: 0 PID: 502 Comm: syz.2.97 Not tainted syzkaller #0 [ 25.789075][ T502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 25.799122][ T502] Call Trace: [ 25.802407][ T502] __dump_stack+0x21/0x24 [ 25.806737][ T502] dump_stack_lvl+0x1a7/0x208 [ 25.811413][ T502] ? show_regs_print_info+0x18/0x18 [ 25.816599][ T502] ? thaw_kernel_threads+0x220/0x220 [ 25.821858][ T502] print_address_description+0x7f/0x2c0 [ 25.827378][ T502] ? tc_setup_flow_action+0x88e/0x3160 [ 25.832813][ T502] kasan_report+0x100/0x140 [ 25.837294][ T502] ? flow_action_cookie_create+0x28/0x90 [ 25.842931][ T502] ? tc_setup_flow_action+0x88e/0x3160 [ 25.848368][ T502] __asan_report_load8_noabort+0x14/0x20 [ 25.853986][ T502] tc_setup_flow_action+0x88e/0x3160 [ 25.859275][ T502] mall_replace_hw_filter+0x2db/0x8c0 [ 25.864640][ T502] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 25.870698][ T502] ? mall_set_parms+0x450/0x450 [ 25.875544][ T502] ? tcf_exts_destroy+0xb0/0xb0 [ 25.880394][ T502] ? pcpu_alloc+0xf8d/0x16c0 [ 25.884969][ T502] ? mall_set_parms+0x1a0/0x450 [ 25.889797][ T502] mall_change+0x546/0x770 [ 25.894196][ T502] ? __kasan_check_write+0x14/0x20 [ 25.899292][ T502] ? mall_get+0xa0/0xa0 [ 25.903424][ T502] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 25.909290][ T502] tc_new_tfilter+0x1487/0x1ab0 [ 25.914134][ T502] ? mall_get+0xa0/0xa0 [ 25.918267][ T502] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.923898][ T502] ? security_capable+0x87/0xb0 [ 25.928738][ T502] ? ns_capable+0x8c/0xf0 [ 25.933058][ T502] ? netlink_net_capable+0x125/0x160 [ 25.938325][ T502] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.943939][ T502] rtnetlink_rcv_msg+0x811/0xca0 [ 25.948867][ T502] ? unwind_get_return_address+0x4d/0x90 [ 25.954487][ T502] ? rtnetlink_bind+0x80/0x80 [ 25.959146][ T502] ? stack_trace_save+0xa6/0xf0 [ 25.963989][ T502] ? stack_trace_snprint+0xe0/0xe0 [ 25.969092][ T502] ? avc_has_perm+0x168/0x3d0 [ 25.973759][ T502] ? memcpy+0x56/0x70 [ 25.977728][ T502] ? avc_has_perm+0x27f/0x3d0 [ 25.982382][ T502] ? __kasan_slab_alloc+0xc9/0xe0 [ 25.987383][ T502] ? avc_has_perm_noaudit+0x260/0x260 [ 25.992732][ T502] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.998778][ T502] ? selinux_nlmsg_lookup+0x398/0x430 [ 26.004122][ T502] netlink_rcv_skb+0x1e9/0x430 [ 26.008859][ T502] ? rtnetlink_bind+0x80/0x80 [ 26.013507][ T502] ? netlink_ack+0xb30/0xb30 [ 26.018077][ T502] ? __netlink_lookup+0x387/0x3b0 [ 26.023094][ T502] rtnetlink_rcv+0x1c/0x20 [ 26.027482][ T502] netlink_unicast+0x86c/0xa30 [ 26.032218][ T502] netlink_sendmsg+0x949/0xb70 [ 26.036962][ T502] ? schedule_preempt_disabled+0x20/0x20 [ 26.042572][ T502] ? netlink_getsockopt+0x530/0x530 [ 26.047749][ T502] ? security_socket_sendmsg+0x82/0xa0 [ 26.053180][ T502] ? netlink_getsockopt+0x530/0x530 [ 26.058355][ T502] ____sys_sendmsg+0x5be/0x8f0 [ 26.063103][ T502] ? __sys_sendmsg_sock+0x40/0x40 [ 26.068103][ T502] ? import_iovec+0x7c/0xb0 [ 26.072585][ T502] ___sys_sendmsg+0x236/0x2e0 [ 26.077240][ T502] ? __sys_sendmsg+0x280/0x280 [ 26.081978][ T502] ? alloc_file+0x82/0x580 [ 26.086375][ T502] ? __fdget+0x1a1/0x230 [ 26.090598][ T502] __x64_sys_sendmsg+0x201/0x2d0 [ 26.095523][ T502] ? __kasan_check_write+0x14/0x20 [ 26.100627][ T502] ? ___sys_sendmsg+0x2e0/0x2e0 [ 26.105473][ T502] ? __kasan_check_read+0x11/0x20 [ 26.110482][ T502] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 26.116093][ T502] do_syscall_64+0x31/0x40 [ 26.120485][ T502] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.126359][ T502] RIP: 0033:0x7faf06c0ae99 [ 26.130762][ T502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.150350][ T502] RSP: 002b:00007faf05664028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.158742][ T502] RAX: ffffffffffffffda RBX: 00007faf06e92fa0 RCX: 00007faf06c0ae99 [ 26.166703][ T502] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000005 [ 26.174653][ T502] RBP: 00007faf06ca0eaf R08: 0000000000000000 R09: 0000000000000000 [ 26.182602][ T502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.190552][ T502] R13: 00007faf06e93038 R14: 00007faf06e92fa0 R15: 00007ffcdb809ca8 [ 26.198498][ T502] [ 26.200804][ T502] Allocated by task 502: [ 26.205029][ T502] __kasan_kmalloc+0xd4/0x100 [ 26.209685][ T502] __kmalloc+0x19f/0x330 [ 26.213902][ T502] tcf_idr_create+0x5f/0x790 [ 26.218464][ T502] tcf_idr_create_from_flags+0x61/0x70 [ 26.223893][ T502] tcf_gact_init+0x2e6/0x560 [ 26.228456][ T502] tcf_action_init_1+0x443/0x6d0 [ 26.233368][ T502] tcf_action_init+0x227/0x780 [ 26.238103][ T502] tcf_exts_validate+0x23c/0x540 [ 26.243015][ T502] mall_set_parms+0x4a/0x450 [ 26.247578][ T502] mall_change+0x47a/0x770 [ 26.251967][ T502] tc_new_tfilter+0x1487/0x1ab0 [ 26.256793][ T502] rtnetlink_rcv_msg+0x811/0xca0 [ 26.261702][ T502] netlink_rcv_skb+0x1e9/0x430 [ 26.266437][ T502] rtnetlink_rcv+0x1c/0x20 [ 26.270827][ T502] netlink_unicast+0x86c/0xa30 [ 26.275567][ T502] netlink_sendmsg+0x949/0xb70 [ 26.280311][ T502] ____sys_sendmsg+0x5be/0x8f0 [ 26.285049][ T502] ___sys_sendmsg+0x236/0x2e0 [ 26.289699][ T502] __x64_sys_sendmsg+0x201/0x2d0 [ 26.294615][ T502] do_syscall_64+0x31/0x40 [ 26.299015][ T502] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.304883][ T502] [ 26.307192][ T502] The buggy address belongs to the object at ffff88810f580800 [ 26.307192][ T502] which belongs to the cache kmalloc-256 of size 256 [ 26.321221][ T502] The buggy address is located 216 bytes inside of [ 26.321221][ T502] 256-byte region [ffff88810f580800, ffff88810f580900) [ 26.334463][ T502] The buggy address belongs to the page: [ 26.340093][ T502] page:ffffea00043d6000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f580 [ 26.350301][ T502] head:ffffea00043d6000 order:1 compound_mapcount:0 [ 26.356863][ T502] flags: 0x4000000000010200(slab|head) [ 26.362303][ T502] raw: 4000000000010200 ffffea00043d0f80 0000000600000006 ffff888100043200 [ 26.370872][ T502] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.379427][ T502] page dumped because: kasan: bad access detected [ 26.385811][ T502] page_owner tracks the page as allocated [ 26.391522][ T502] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 3876947637, free_ts 0 [ 26.408680][ T502] prep_new_page+0x176/0x190 [ 26.413243][ T502] get_page_from_freelist+0x225f/0x23f0 [ 26.418766][ T502] __alloc_pages_nodemask+0x29a/0x640 [ 26.424113][ T502] new_slab+0x84/0x3f0 [ 26.428172][ T502] ___slab_alloc+0x2f8/0x4c0 [ 26.432744][ T502] __slab_alloc+0x63/0xa0 [ 26.437052][ T502] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 26.442409][ T502] inode_doinit_use_xattr+0x5d/0x400 [ 26.447674][ T502] inode_doinit_with_dentry+0x93a/0xd70 [ 26.453195][ T502] selinux_d_instantiate+0x27/0x40 [ 26.458284][ T502] security_d_instantiate+0x9e/0xf0 [ 26.463457][ T502] d_splice_alias+0x6d/0x390 [ 26.468023][ T502] kernfs_iop_lookup+0x2c5/0x310 [ 26.472934][ T502] path_openat+0x145d/0x3040 [ 26.477499][ T502] do_filp_open+0x1df/0x400 [ 26.481973][ T502] do_sys_openat2+0x19f/0x750 [ 26.486617][ T502] page_owner free stack trace missing [ 26.491954][ T502] [ 26.494254][ T502] Memory state around the buggy address: [ 26.499864][ T502] ffff88810f580780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.507905][ T502] ffff88810f580800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.515948][ T502] >ffff88810f580880: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 26.523984][ T502] ^ [ 26.530893][ T502] ffff88810f580900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.538929][ T502] ffff88810f580980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.546963][ T502] ================================================================== [ 26.554996][ T502] Disabling lock debugging due to kernel taint