Extracting prog: 1h5m51.312272475s
Minimizing prog: 14m14.78428938s
Simplifying prog options: 0s
Extracting C: 1m8.461709369s
Simplifying C: 7m39.938180486s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-mkdirat-ioctl$AUTOFS_DEV_IOCTL_REQUESTER-openat$fuse-mount$fuse-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-socket-sendmsg$NL80211_CMD_CRIT_PROTOCOL_START-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-sendmsg$nl_route-ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL-sendmsg$nl_route-read$FUSE-syz_usb_connect-write$FUSE_INIT-mount$9p_rdma
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 11, 4, 27, 15, 7, 11, 10, 23, 24, 6, 3, 8, 7, 7, 6, 5, 11, 7, 3, 26, 3, 7, 6, 8, 8, 4, 20, 7]
detailed listing:
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 0:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, 0x0, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 0:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv4_deladdr={0x18, 0x15, 0x1, 0xfffffffd, 0x0, {0x2, 0x18, 0x0, 0x0, r1}}, 0x18}}, 0x0)
executing program 0:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$inet6(0xa, 0x80002, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, r1)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f00000025c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x7, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x51}})
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0)
r5 = socket$inet6(0xa, 0x800000000000002, 0x0)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
sendto$inet6(r5, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x50)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004ec0)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x9}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000ec0)={0x14, 0x0, 0x601}, 0x14}}, 0x8000)
r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3)
sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000100)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000400)={0x50, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}]}, 0x50}}, 0x0)
sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f0000000500)={&(0x7f0000000600), 0xc, &(0x7f0000000700)={&(0x7f0000000800)={0x14, r5, 0x301}, 0x14}}, 0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc}, 0xc, &(0x7f00000004c0)={&(0x7f0000000840)={0xb4, r5, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xc}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x597}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xc07}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008000}, 0x800)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x1c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x620b}, 0x0)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_POWER_SAVE(r3, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x218080}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, r6, 0xb, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x0, 0x41}}}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x38}}, 0x4000044)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000640)={r0, r2, 0x25, 0x0, @val=@tracing={0x0, 0x2}}, 0x20)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
executing program 1:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 3:
setns(0xc9, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x21, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0)
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
listen(r2, 0x1)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b007e0b0a42"], 0x97)
executing program 2:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r0, 0x4b65, 0x7)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000000000000000000000000000071183b000000000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
prlimit64(0x0, 0x6, &(0x7f0000000140)={0x0, 0x4}, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00006ec000/0x1000)=nil, &(0x7f00002c7000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000559000/0x4000)=nil, &(0x7f000008d000/0x1000)=nil, &(0x7f00005e2000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000021a000/0x1000)=nil, &(0x7f00005e1000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a001fffffffff7f0000000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b'], 0x24}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0208"], 0x48)
io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000500)=ANY=[@ANYBLOB="740000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800c0001006d6163766c616e003c00028008000100100000001c0005800a000400aaaaaaaaaabb000002000400d8928afb7028000008000300030000000a000400aaaaaaaaaabb00", @ANYRES32=r1], 0x74}, 0x1, 0x0, 0x0, 0xc00}, 0x2044890)
ioctl$BTRFS_IOC_WAIT_SYNC(r1, 0x40089416, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x60280, 0x0)
ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000000)=@generic={0x1, 0x0, 0x9})
r4 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x190)
r5 = socket$inet6(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4)
bind$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c)
sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002740)=ANY=[@ANYBLOB="280000001000010025bd7000f9dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="158804000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040881}, 0x4000000)
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioprio_get$uid(0x3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}})
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10)
unshare(0x42000000)
unshare(0x64000600)
unshare(0x10010400)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500007100", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0xc441}, 0x40040d4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf2505000000200001800d0001007564703a73797a32"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0)
write$tun(r0, &(0x7f0000000000)={@val={0x0, 0x88e7}, @val={0x2, 0x0, 0x9, 0x8, 0x6a, 0x4}, @arp=@generic={0xfffe, 0x8864, 0x6, 0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, "", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}}, 0x22)
executing program 4:
write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000edffffffffffffff00000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000000002000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x844)
executing program 2:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000640)={r1, r3, 0x25, 0x0, @val=@tracing={0x0, 0x2}}, 0x20)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
executing program 4:
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0xffffffffffffffff, 0x1, 0x1}}, 0x40)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x2, 0x7ffc1ffb}]})
fremovexattr(0xffffffffffffffff, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6)
r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind(r3, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0xb, 0x0, 0x4, {0xa, 0x4e24, 0x2f2, @rand_addr=' \x01\x00', 0x6}}}, 0x80)
getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, &(0x7f0000000780))
setns(0xc9, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10}, 0x0)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014)
recvmmsg(r4, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x102, 0x0)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000540)={0x3, &(0x7f0000000400)=[{0x3, 0x1, 0x0, 0x9}, {0x1, 0x60, 0x4, 0x69}, {0x8, 0x2, 0x1, 0xdb}]})
connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904"], 0x0)
executing program 4:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x9, @none, 0x0, 0x2}, 0xe)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <29>
bisect: split chunk #0 of len 29 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 6, 3, 8, 7, 7, 6, 5, 11, 7, 3, 26, 3, 7, 6, 8, 8, 4, 20, 7]
detailed listing:
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioprio_get$uid(0x3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}})
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10)
unshare(0x42000000)
unshare(0x64000600)
unshare(0x10010400)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500007100", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0xc441}, 0x40040d4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf2505000000200001800d0001007564703a73797a32"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0)
write$tun(r0, &(0x7f0000000000)={@val={0x0, 0x88e7}, @val={0x2, 0x0, 0x9, 0x8, 0x6a, 0x4}, @arp=@generic={0xfffe, 0x8864, 0x6, 0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, "", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}}, 0x22)
executing program 4:
write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000edffffffffffffff00000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000000002000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x844)
executing program 2:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000640)={r1, r3, 0x25, 0x0, @val=@tracing={0x0, 0x2}}, 0x20)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
executing program 4:
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0xffffffffffffffff, 0x1, 0x1}}, 0x40)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x2, 0x7ffc1ffb}]})
fremovexattr(0xffffffffffffffff, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6)
r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind(r3, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0xb, 0x0, 0x4, {0xa, 0x4e24, 0x2f2, @rand_addr=' \x01\x00', 0x6}}}, 0x80)
getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, &(0x7f0000000780))
setns(0xc9, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10}, 0x0)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014)
recvmmsg(r4, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x102, 0x0)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000540)={0x3, &(0x7f0000000400)=[{0x3, 0x1, 0x0, 0x9}, {0x1, 0x60, 0x4, 0x69}, {0x8, 0x2, 0x1, 0xdb}]})
connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904"], 0x0)
executing program 4:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x9, @none, 0x0, 0x2}, 0xe)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 26, 3, 7, 6, 8, 8, 4, 20, 7]
detailed listing:
executing program 4:
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0xffffffffffffffff, 0x1, 0x1}}, 0x40)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x2, 0x7ffc1ffb}]})
fremovexattr(0xffffffffffffffff, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6)
r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind(r3, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0xb, 0x0, 0x4, {0xa, 0x4e24, 0x2f2, @rand_addr=' \x01\x00', 0x6}}}, 0x80)
getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, &(0x7f0000000780))
setns(0xc9, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10}, 0x0)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014)
recvmmsg(r4, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x102, 0x0)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000540)={0x3, &(0x7f0000000400)=[{0x3, 0x1, 0x0, 0x9}, {0x1, 0x60, 0x4, 0x69}, {0x8, 0x2, 0x1, 0xdb}]})
connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904"], 0x0)
executing program 4:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x9, @none, 0x0, 0x2}, 0xe)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 6, 3, 8, 7, 7, 6, 5, 11, 7, 20]
detailed listing:
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioprio_get$uid(0x3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}})
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10)
unshare(0x42000000)
unshare(0x64000600)
unshare(0x10010400)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500007100", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0xc441}, 0x40040d4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf2505000000200001800d0001007564703a73797a32"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0)
write$tun(r0, &(0x7f0000000000)={@val={0x0, 0x88e7}, @val={0x2, 0x0, 0x9, 0x8, 0x6a, 0x4}, @arp=@generic={0xfffe, 0x8864, 0x6, 0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, "", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}}, 0x22)
executing program 4:
write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000edffffffffffffff00000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000000002000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x844)
executing program 2:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000640)={r1, r3, 0x25, 0x0, @val=@tracing={0x0, 0x2}}, 0x20)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})

program did not crash
bisect: split chunks (needed=true): <10>, <9>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 6, 5, 11, 7, 3, 26, 3, 7, 6, 8, 8, 4, 20, 7]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0)
write$tun(r0, &(0x7f0000000000)={@val={0x0, 0x88e7}, @val={0x2, 0x0, 0x9, 0x8, 0x6a, 0x4}, @arp=@generic={0xfffe, 0x8864, 0x6, 0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, "", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}}, 0x22)
executing program 4:
write$dsp(0xffffffffffffffff, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0)
executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="3801000010000100feffffff00010000fe880000000000000000000000000001fc010000edffffffffffffff00000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000800000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000070000000000000002000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x844)
executing program 2:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20a03, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000640)={r1, r3, 0x25, 0x0, @val=@tracing={0x0, 0x2}}, 0x20)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
executing program 4:
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0xffffffffffffffff, 0x1, 0x1}}, 0x40)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x2, 0x7ffc1ffb}]})
fremovexattr(0xffffffffffffffff, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6)
r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind(r3, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0xb, 0x0, 0x4, {0xa, 0x4e24, 0x2f2, @rand_addr=' \x01\x00', 0x6}}}, 0x80)
getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, &(0x7f0000000780))
setns(0xc9, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10}, 0x0)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014)
recvmmsg(r4, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x102, 0x0)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000540)={0x3, &(0x7f0000000400)=[{0x3, 0x1, 0x0, 0x9}, {0x1, 0x60, 0x4, 0x69}, {0x8, 0x2, 0x1, 0xdb}]})
connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904"], 0x0)
executing program 4:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x9, @none, 0x0, 0x2}, 0xe)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 6, 3, 8, 7, 3, 26, 3, 7, 6, 8, 8, 4, 20, 7]
detailed listing:
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioprio_get$uid(0x3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}})
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10)
unshare(0x42000000)
unshare(0x64000600)
unshare(0x10010400)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500007100", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0xc441}, 0x40040d4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf2505000000200001800d0001007564703a73797a32"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 4:
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003008400000000000000ff10850000000700000095"], 0x0, 0x2, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0xffffffffffffffff, 0x1, 0x1}}, 0x40)
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x2, 0x7ffc1ffb}]})
fremovexattr(0xffffffffffffffff, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6)
r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind(r3, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0xb, 0x0, 0x4, {0xa, 0x4e24, 0x2f2, @rand_addr=' \x01\x00', 0x6}}}, 0x80)
getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, &(0x7f0000000780))
setns(0xc9, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10}, 0x0)
sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014)
recvmmsg(r4, &(0x7f0000003900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x102, 0x0)
r6 = socket$vsock_stream(0x28, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000540)={0x3, &(0x7f0000000400)=[{0x3, 0x1, 0x0, 0x9}, {0x1, 0x60, 0x4, 0x69}, {0x8, 0x2, 0x1, 0xdb}]})
connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904"], 0x0)
executing program 4:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7ff}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x9, @none, 0x0, 0x2}, 0xe)
executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000240))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3})
madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x17)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}}, 0x24}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001240)=@newtfilter={0x44, 0x2c, 0x401, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xe, 0x9}}]}}]}, 0x44}}, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: split chunk #1 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 6, 3, 8, 7, 8, 8, 4, 20, 7]
detailed listing:
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioprio_get$uid(0x3, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000480)={'veth1_virt_wifi\x00', &(0x7f0000000400)=@ethtool_dump={0x32, 0x9, 0x6, 0x2a, "ad53a3712b67940eda0a0159c9030ecbb9013538fc898ae4948b99d24a3703d5de077c92c17fca16650d"}})
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r4, &(0x7f0000002680)=[{{&(0x7f0000000280)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000300)='\x00', 0x1}], 0x1}}, {{&(0x7f0000000380)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, &(0x7f00000025c0)=[{&(0x7f00000003c0)="1695", 0x2}], 0x1}}], 0x2, 0x48000)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000100)={0x571e, 0x202, 0x1, 0x4}, 0x10)
unshare(0x42000000)
unshare(0x64000600)
unshare(0x10010400)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', <r3=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500007100", @ANYRES32=r3, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0xc441}, 0x40040d4)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf2505000000200001800d0001007564703a73797a32"], 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>, <4>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 8, 8, 4, 20, 7]
detailed listing:
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 4, 20, 7]
detailed listing:
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 8, 8, 20]
detailed listing:
executing program 2:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})

program did not crash
bisect: split chunks (needed=true): <2>, <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 8, 8, 4, 20, 7]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[], 0x20}}, 0x800)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 8, 4, 20, 7]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #2 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 8, 20, 7]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 8, 4, 20]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})

program did not crash
bisect: split chunks (needed=true): <1>, <1>, <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #2 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #3 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 5 programs left: 

executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
r1 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)


bisect: trying to concatenate
bisect: concatenate 5 entries
minimizing program #0 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0xffffffff, 0x0, 0x0, 0x20, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080))
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 8, 4, 20, 7]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190)
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 4, 20, 7]
detailed listing:
executing program 0:
executing program 3:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x20, 0x2, 0x81, 0xfffff034}]}, 0x10)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
minimized 7 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$packet(0x11, 0x2, 0x300)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 1, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 4, 20, 7]
detailed listing:
executing program 4:
executing program 0:
executing program 3:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x700000000000000}, 0x0)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
minimized 8 calls -> 0 calls
minimizing program #2 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 3, 20, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 0:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 2, 20, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 0:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 1, 20, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 0:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000003f00090000000000000800000300000004000000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4)
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 20, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 0:
executing program 1:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {<r1=>0x0, 0xee00}}, './mnt\x00'})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r7}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r8=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r2, &(0x7f00000041c0)={0x2020, 0x0, <r9=>0x0, <r10=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000040)='./dev\x00', &(0x7f0000000180), 0x204001, &(0x7f0000000200)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x5}}], [{@fowner_gt={'fowner>', r1}}, {@subj_role={'subj_role', 0x3d, '-/:)\x88'}}, {@fsmagic={'fsmagic', 0x3d, 0x28000000}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@euid_eq={'euid', 0x3d, r10}}]}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
minimized 4 calls -> 0 calls
minimizing program #3 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 19, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r3=>0x0})
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r6, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r6}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r7=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r3}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r1, &(0x7f00000041c0)={0x2020, 0x0, <r8=>0x0}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
write$FUSE_INIT(r1, &(0x7f0000000380)={0x50, 0x0, r8, {0x7, 0x2b, 0x0, 0x58441044, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x10000}}, 0x50)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 18, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r3=>0x0})
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r6, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r6}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r7=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r3}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r1, &(0x7f00000041c0)={0x2020}, 0x2020)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000680)=ANY=[@ANYBLOB="120100005bd30a20f0031d58a3200122030109021b0002000000000904250000ff0120000904"], 0x0)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 17, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r3=>0x0})
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r6, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r6}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r7=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r3}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
read$FUSE(r1, &(0x7f00000041c0)={0x2020}, 0x2020)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 16, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', <r2=>0x0})
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r5, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', <r6=>0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@mpls_getnetconf={0x44, 0x52, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r2}, @NETCONFA_IFINDEX={0x8, 0x1, r5}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r6}]}, 0x44}, 0x1, 0x0, 0x0, 0xc1}, 0x8840)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 15, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r3, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x40}}, 0x440b0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000540)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', 0x0, 0x8000, 0x8, 0x3, 0x7, {{0x3e, 0x4, 0x0, 0x2c, 0xf8, 0x64, 0x6, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x24, 0x67, 0x1, 0x0, [{@loopback}, {@local, 0x1c}, {@private=0xa010101, 0x91}, {@multicast1, 0x9b}]}, @ssrr={0x89, 0x1b, 0x7, [@local, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x17, 0xf7, [@remote, @loopback, @private=0xa010100, @private=0xa010102, @broadcast]}, @generic={0x94, 0x6, "525fc728"}, @end, @noop, @ra={0x94, 0x4}, @cipso={0x86, 0x7b, 0xffffffffffffffff, [{0x6, 0xa, "d5b4ec882323433f"}, {0x1, 0x5, "0ace29"}, {0x5, 0xc, "e7848fedc36d830c9d92"}, {0x6, 0x11, "b63a8fbee59bb4edd0725adcb90cf4"}, {0x1, 0x11, "bd4fa4773920b20be4bd3c9c38bdcf"}, {0x0, 0xf, "96d3d60172f66fec8ea537c2e9"}, {0x6, 0xf, "555c5e3c822b38c094833b8655"}, {0x6, 0x12, "c35eaa95c47c756e152a679c41aa688d"}, {0x0, 0x8, "be2ab7243b87"}]}, @lsrr={0x83, 0x7, 0x77, [@multicast1]}]}}}}})
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 14, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r3, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x40}}, 0x440b0)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: kernel BUG in pskb_expand_head
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 13, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r3, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 12, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 11, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 11, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 11, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 10, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket$netlink(0x10, 0x3, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 10, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080))
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 10, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 9, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 8, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 7, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './mnt\x00'})
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 6, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 5, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 7]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
minimized 20 calls -> 4 calls
minimizing program #4 before concatenation
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 6]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)
gettid()

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 5]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000040)=0x9b8)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 4]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 3]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 2]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)
write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 1]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:
openat$dsp(0xffffffffffffff9c, 0x0, 0x8041, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 0, 4, 0]
detailed listing:
executing program 4:
executing program 3:
executing program 3:
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)
executing program 0:

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
minimized 7 calls -> 0 calls
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket(0x10, 0x803, 0x0)
getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000600)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r1, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket(0x10, 0x803, 0x0)
getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r1, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, 0x0, &(0x7f0000000080))
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, 0x0, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x40000)

program did not crash
testing program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program did not crash
extracting C reproducer
testing compiled C program (duration=46.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
simplifying C reproducer
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program did not crash
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing compiled C program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
program crashed: BUG: MAX_LOCKDEP_KEYS too low!
testing program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
testing program (duration=46.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-getsockname$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
reproducing took 1h32m11.923342178s
repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_KEYS too low!
turning off the locking correctness validator.
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: events_unbound linkwatch_event
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 register_lock_class+0x4f8/0x690 kernel/locking/lockdep.c:1319
 __lock_acquire+0x164/0x6634 kernel/locking/lockdep.c:4942
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 dev_reset_queue+0x104/0x1f0 include/net/sch_generic.h:682
 netdev_for_each_tx_queue include/linux/netdevice.h:2467 [inline]
 dev_deactivate_many+0x530/0xa84 net/sched/sch_generic.c:1349
 dev_deactivate+0x118/0x1b4 net/sched/sch_generic.c:1372
 linkwatch_do_dev+0xfc/0x194 net/core/link_watch.c:166
 __linkwatch_run_queue+0x360/0x640 net/core/link_watch.c:221
 linkwatch_event+0x58/0x68 net/core/link_watch.c:264
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready

final repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_KEYS too low!
turning off the locking correctness validator.
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: events_unbound linkwatch_event
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 register_lock_class+0x4f8/0x690 kernel/locking/lockdep.c:1319
 __lock_acquire+0x164/0x6634 kernel/locking/lockdep.c:4942
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
 _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 dev_reset_queue+0x104/0x1f0 include/net/sch_generic.h:682
 netdev_for_each_tx_queue include/linux/netdevice.h:2467 [inline]
 dev_deactivate_many+0x530/0xa84 net/sched/sch_generic.c:1349
 dev_deactivate+0x118/0x1b4 net/sched/sch_generic.c:1372
 linkwatch_do_dev+0xfc/0x194 net/core/link_watch.c:166
 __linkwatch_run_queue+0x360/0x640 net/core/link_watch.c:221
 linkwatch_event+0x58/0x68 net/core/link_watch.c:264
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready