Extracting prog: 1h33m13.038542291s Minimizing prog: 45m55.057916335s Simplifying prog options: 15m56.513379239s Extracting C: 5m23.698560164s Simplifying C: 0s extracting reproducer from 66 programs testing a last program of every proc single: executing 16 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$inet_sctp-getsockopt$inet_sctp_SCTP_RECVRCVINFO-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_STAT_GET-setsockopt$MRT6_ADD_MIF-socket$netlink-connect$inet-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CHECK_EXTENSION_VM-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_GET_LIMITS-request_key detailed listing: executing program 0: r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x1411, 0x200, 0x70bd27, 0x25dfdbfa, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0xfffffffffffffd11, 0x4b, 0x35}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast2}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x7fffff) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4a) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r6, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x80000) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendto$packet-getsockname$packet-openat$ptmx-openat-write$binfmt_aout-mmap-madvise-write$uinput_user_dev-openat$kvm-sendmsg$nl_xfrm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-ioctl$IOMMU_IOAS_COPY$syz-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-openat$iommufd-ioctl$IOMMU_IOAS_COPY-madvise-gettid detailed listing: executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) sendto$packet(r0, 0x0, 0x0, 0x4040, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[], 0xfffffee2) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xf, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x7, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, 0x0, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1800, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r9, 0x3b83, &(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x6, 0x800003, 0xc53}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3) gettid() program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$kcm-socket$kcm-sendmsg$kcm-socket$phonet_pipe-connect$phonet_pipe-socket$can_raw-openat$hwrng-close_range-getsockopt$CAN_RAW_RECV_OWN_MSGS-sendmsg$inet detailed listing: executing program 0: socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000010008104687da3aa7143a0b8c81d080300000000000000a118001500060014000040a8002b000e00014006046109d67f6f94007134cf6ee0a000a0e408e8d8ef52a9bbc7c0b7a196e6f66112c88a2ddddbbb219c6c09136dd481c4a918d1bcf0f938ba3495169ea70948047ec4a5d060a517898516277ce06bbace6f177ccbec4c2ee5a7cef4260027836b0d17a54ef5d6d9342484286f95728886fffcc44841a6db702f071f468430dfe1d9d322fe7c0acfa5fefec64193071e9f00feffff16ac9609f4fb00"/216, 0xd8}], 0x1}, 0x4004) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000280)={0x23, 0x7f, 0x3, 0x1b}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) close_range(r4, r0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230686f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8040880) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-socket$nl_xfrm-syz_fuse_handle_req-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io-sendmsg$nl_xfrm-connect$pppl2tp-syz_kvm_add_vcpu$x86-syz_init_net_socket$x25-open_by_handle_at-bind$x25-openat$mice-syz_open_dev$evdev-socket$inet6_sctp-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST-setsockopt$inet_sctp6_SCTP_DELAYED_SACK-write$char_usb detailed listing: executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="df0d0200000037b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000640)={0x40, 0xf, 0xf, "aa63c2a22a007afb3282cf2f77dfb1"}, 0x0, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @loopback}, 0x2, 0x2, 0x4}}, 0x26) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_load_code={0x12e, 0x59, {0x0, "0f01dff23e0fcec4a17dd7d566baa100b0cdeec42220f38b0100000066baa100ed3ef3410f0966b8f3008ec066baf80cb81809ed8eef66bafc0cec36262e450f30"}}, @set_irq_handler={0xc8, 0x20, {0x7c, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xdb, 0x2, 0x8}}, @out_dx={0x6a, 0x28, {0x265e, 0x4, 0x8}}, @wrmsr={0x65, 0x20, {0x8a5, 0x100}}, @nested_amd_clgi={0x17f, 0x10}], 0x139}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) bind$x25(r2, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r6, 0x1, 0xff}, 0xc) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-timer_settime-socket$inet_tcp-bind$inet-recvmmsg-openat$snapshot detailed listing: executing program 0: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-timer_settime-socket$inet_tcp-bind$inet-recvmmsg-openat$snapshot detailed listing: executing program 0: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-syz_emit_vhci-ioctl$XFS_IOC_FD_TO_HANDLE-openat$cgroup_ro-statx-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_MD5SIG-quotactl_fd$Q_SETQUOTA detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-syz_emit_vhci-ioctl$XFS_IOC_FD_TO_HANDLE-openat$cgroup_ro-statx-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_MD5SIG-quotactl_fd$Q_SETQUOTA detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$802154_dgram-mkdirat-openat$ptmx-mkdir-rt_sigprocmask-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$netlink-writev-gettid-syz_open_dev$usbfs-capset-mount$overlay detailed listing: executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$802154_dgram-mkdirat-openat$ptmx-mkdir-rt_sigprocmask-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$netlink-writev-gettid-syz_open_dev$usbfs-capset-mount$overlay detailed listing: executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) program did not crash single: failed to extract reproducer bisect: bisecting 66 programs with base timeout 30s testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 16, 28, 15, 6, 13, 13, 6, 14, 4, 14, 30, 2, 2, 2, 11, 2, 10, 3, 10, 10, 8, 16, 23, 30, 30, 3, 3, 7, 9, 3, 7, 3, 6, 6, 7, 7, 7, 5, 3, 5, 5, 3, 8, 16, 21, 22, 7, 21, 5, 9, 16, 8, 18, 11, 6, 9, 7, 22, 5, 6, 18, 11, 2, 30, 14] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000900)={'vxcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) sendmsg$can_raw(r3, &(0x7f00000004c0)={&(0x7f0000000140)={0x1d, r2}, 0x10, &(0x7f0000000940)={&(0x7f0000000000)=@can={{0x0, 0x0, 0x0, 0x1}, 0x1, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x10}, 0x1, 0x0, 0x0, 0x84844}, 0x14) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={r2, @local, @private=0xa010102}, 0xc) r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000040)={0x1, 0x2, @start={0x5, 0x1}}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x78, r1, 0x1, 0x70bd24, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x41}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8b3c}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffa00}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}]}, 0x78}}, 0x48040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)={0x2, 0x0, @b}, 0x48, 0xfffffffffffffffb) keyctl$revoke(0x3, r3) (async) keyctl$revoke(0x3, r3) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x34, 0x0, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8100}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @tcp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x4) (async) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x34, 0x0, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8100}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @tcp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x4) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r4, {0xee01, 0xee01}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r4, {0xee01, 0xee01}}, './file0\x00'}) io_submit(0x0, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x2, 0x6, 0xffffffffffffffff, &(0x7f0000000280)="3d0964aea57c4325f40d420a946a424533e9f0c0f7ac4020c6e786ec0d88aaa7411c6b3e4ceac3117bc3339211eced8826047dc8474046a4e6656f921309a503366d9c83dc7774955d8d384ba992fe2e65211ea8b504c7b877eea4807ce55c98d8768c3cb8ae487bc256", 0x6a, 0xa3, 0x0, 0x0, r5}]) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r4, 0xc018620c, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x184004, &(0x7f0000000180)={[{@inode64}, {@grpquota_block_hardlimit={'grpquota_block_hardlimit', 0x3d, [0x34, 0x78]}}], [{@pcr={'pcr', 0x3d, 0x10}}, {@hash}, {@audit}]}) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) (async, rerun: 32) socket$netlink(0x10, 0x3, 0x2) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async, rerun: 64) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff, 0x10000}) (async, rerun: 64) close(0xffffffffffffffff) (async, rerun: 32) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000680)={r4, 0x1ff, 0x0, 0x1, 0x3, [], [0x7fdfffff, 0x0, 0x0, 0x4], [0x0, 0x1001000, 0x1], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) (async, rerun: 32) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000890000/0x4000)=nil, 0x4000}}) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r8 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000086a82, 0x0) (async, rerun: 64) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000000)=0x1008200, 0x4) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r10, 0x405c5503, 0x0) fadvise64(r9, 0x3, 0x1, 0x4) (async, rerun: 32) sendto$packet(r8, 0x0, 0x0, 0x50040, &(0x7f0000000540)={0x11, 0xc, r7, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x14) (rerun: 32) executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) ioctl$USBDEVFS_BULK(r0, 0x5523, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) (async, rerun: 64) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (rerun: 64) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000280)={[{@uuid_null}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}], [{@smackfsfloor={'smackfsfloor', 0x3d, ']*-$'}}, {@dont_hash}, {@appraise}, {@measure}, {@appraise}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@subj_type={'subj_type', 0x3d, ',[,&)*-\x05'}}]}) r1 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x10000000}, 0xc) (async) bind$netlink(r1, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbfb, 0x808b9027}, 0xc) chdir(&(0x7f00000001c0)='./bus\x00') (async) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) executing program 0: modify_ldt$write2(0x11, &(0x7f0000000200)={0x77b, 0x0, 0x0, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000002140)=""/4098, 0xfffffffffffffe8e) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f0000000040)) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400800000a0a0102"], 0x840}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) executing program 32: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) executing program 1: kexec_load(0x2, 0x0, &(0x7f0000001180), 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001f00)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000007540), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000007640)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000000)={0x24, r3, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}]}, 0x24}, 0x1, 0x0, 0x0, 0x44040}, 0x0) executing program 1: r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='stack\x00') (async) r2 = syz_io_uring_setup(0x2af8, &(0x7f0000000380)={0x0, 0xc562, 0x13090, 0x0, 0x71}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r3, &(0x7f0000002240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002200)={&(0x7f0000000180)={0x3c, 0x2, 0x8, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x200}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4810) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xc8}}, 0x4000040) (async, rerun: 32) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) (rerun: 32) socket$kcm(0x2, 0xa, 0x2) write$tun(r4, &(0x7f00000000c0)=ANY=[], 0xffe) (async, rerun: 32) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') (rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async, rerun: 32) read$FUSE(r5, &(0x7f00000001c0)={0x2020}, 0x2020) (rerun: 32) poll(&(0x7f0000000f00)=[{r2}], 0x1, 0xc) getdents(r1, &(0x7f0000000040)=""/56, 0x38) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x34, 0x41, 0x107, 0x70bd2c, 0x25dfdbfa, {0x3, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0x1c, 0x1, 0x0, 0x1, [@nested={0x18, 0x10, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@loopback}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYRES64=r1], 0xd0}, 0x1, 0x0, 0x0, 0x24044890}, 0x0) executing program 1: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000004c0)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x6, 0xfdcd, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x24, 0x63, 0x0, 0x40, 0x11, 0x0, @private=0xa010104, @broadcast}, {0x4e26, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x81, 0x0, @val=0x80}}}}}, 0x32) executing program 1: r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x6c, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x58, 0xe, 0x0, 0x1, [@nested={0x54, 0x52, 0x0, 0x1, [@generic="6f784e8df96ddb651128a7a38ffcf1dd0308c33fa12db8a947f424a892a831217f9a97a3764574383b7ef8d45cf916d331c46b86459433ae9ec3f9ca195b5ed7a145aead9f1e384cf57ef81d5b7862a0"]}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) landlock_restrict_self(r0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x9b4, 0x0, 0x0, 0x1000, 0xffffffff, r6, 0x0, 0x3}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x0, 0x5008, 0x4000001, 0x257, 0x0, r9}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x2, 0x0, 0x146, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x1, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9efe, 0x8000, 0x1, 0xfffffffd}}], 0x1, &(0x7f00000003c0)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) r10 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r10, 0xf) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r11, 0x84, 0x81, &(0x7f0000001040)="0000000000000002", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r11, 0x84, 0x15, &(0x7f0000000000)={0x1}, 0x1) r12 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r12, 0x4058534c, &(0x7f0000000000)={0x80, 0x10000009, 0xc8, 0xe05, 0x20000, 0x28e7}) landlock_restrict_self(r0, 0xb) landlock_restrict_self(r10, 0x0) r13 = socket$inet(0x2, 0x4000000000000001, 0x0) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r14, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000050000000900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a308000000008000a4000000003280004800800024000000012080001400000000014000300776c616e30000000000000000000000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x20044841}, 0x802) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x50, &(0x7f0000000000)={0x0, 0x0}, 0x10) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) r15 = syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x200) ioctl$SCSI_IOCTL_START_UNIT(r15, 0x5) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r16 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x2, 0x54000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r16, 0x301, 0x1001f) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 33: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a3000f000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: r0 = socket$key(0xf, 0x3, 0x2) userfaultfd(0xc00) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="020320001200000000000000000000000400030000000000000000000000000000000000000000010000000000000000030006000000000002004e206401010400000000000000000400040000000015feffff06ffffffff000000000000000000000000000000000200010000000000000063fd000000a0030005002b00000002"], 0x90}}, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) syz_clone(0x40808000, &(0x7f0000000080)="a9a8d82c521e2c8a8c235efccc8aa8e1b8d6392314a5b5fed82c56213d3257008f16efd66610", 0x26, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="cb3a1d23f722099b308f963127a82ac4b7dc3280ec7fd6740fc99c17ff6d4f2c064ff574f6fb4fa8afb21d3ab249b273ab8451c289474dff97de73eedc36908fc35f672ef44bc199c803285ea596f12c62b9579b8980a694f2def991997f13052dd21249ca7a8df77dfc1d263def92d9eb449980c3ce5e626fd209222da04fc7d5dadf0b073b37e2469e876833d5b7d28ffe29909cd30f65b18fe2dd0adfb687fc7294c2620f8318d45c06ff184f66ba3c0994658f929ba862a92999bf2862508b8a480d4f03445f4fc8f32261214d") ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000040)) r2 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) writev(r3, &(0x7f0000001900)=[{&(0x7f00000002c0)="984f9c3d953f60a56b79d48c3bd707fc74d54715a184722ea64372bb3ec2bbdecadd086a14b2c7357680599448ceb30b19c5f620f0e2d05cc1966592a1834241d127ef979c8ea59095a40bf2a3d10f3196a918694761a1186507fc47a927e8826dc1c7f47e2885e4cb4d0a6f9dc7ec35ee11dabc214e68964e530088304ebedede5483d0cd9bdc59cb5dee9549ee4d97be5bd725993f51108da28a96a7fe4339fc799d2b10a8cfc2ab0794f7c2c0882d6e2d1a5dbc546a2f6274b70a1338aad44719b358a927f3ec3eb48a1c247bc9c1e770", 0xd2}, {&(0x7f00000003c0)="c2af8cb4a4276a13134ab0d200e2ba655c09b119f6c01d1ef62e77e352e7489f3f717e75e3011f5e9575598d8cc8552342421b236d40a7fc87407e77822526cac1344f9cb4b20272f066e4250ec77716c4efae53424c30ea385b1903ee60b140b239d65cd825f8d24db3b3706d8dfafb40a6d1f0d5c94fb31a0d6ba3ba3584f9a933223b2eb06727dbea77addc5f452f7ca3a861f709537d9fa5522252ae45db7e6eaece05c9293ac27c5b16aa2aa22281f77ff40ec14809d9549386e9b750d1b96d542d8ab101d17cbfa075e8a01c02274d92d14fd0", 0xd6}, {&(0x7f00000004c0)="5ae080571365ab77efdfc6a969b5308d2c7c63f7af241d580e2ada3ed65cf8c5d74e67e503b54eb95c3cf30027359035a04d710944d29d47c4c51e6cc044e7a63dc646b9ddb53d5c9f23d94bd44a873fc02852f5c1fe2ca81737cc0fb4868585fd872a18bb1fd7e28ee7dd07df6cd996c9232906b5e380290f58fd8841a98af055c23e93723e50e67171ebf23578b36e6668ed7235ed0fcc8225bc8d6d530b399526ffa4d91dc9b9f8afe078623a9938eda5ba3f", 0xb4}, {&(0x7f0000000640)="5a4e9e9b10bbec3e2ed75f4cf5f101caa1ab4aebd3b34816387d702f2abcc2f7a3b4e42f279911f8edcd95210cca1b84f3ddb8155aa162cc4c1a25ba768054df764a02f9387d54d3e0ad554a8d52e77ea340b399cd967a80b836c8a2484b918e315cba2dd118077c1cc31a8e3db4d07385ef5d7ddac607abb7a3b5a2ebb5d1502b13279ae1967124decc5fa8492ede12ee575267a80368432bdf393fe3e4ed5d0c1f4b2a6e42960a106c2e566c537d5397d779ac8319c7bf305a45a0de716546cacecd9c682304e8a358b194f1a48ca630b5c4fd24f355bcd5a128c2214dd79b59988a67ab10536ee1e649bad5bad42c804af709bdadcbe8819323b2c7fafc5f0cd41c1d211f5ec1d9b66528df66c38cf8a9ea534e132ddca512fc6d136c08c5b950fe8c38049e817152815e90dcfd74307a10bc54206c5faba13d03ae06c65c2bc4ce8ddea9557dd9b7bee0effa7afd12988631a9a0a42fbe575b31a9d38163214ca1aba3211419260a581a508d2610fce02abff6fb53c9f878d9c5b8dfd6526a05e46b3e23cfe1ff4a2a9f5a3b868abe8040b24be367ede37f4147486531055f8128a23802d21c9d0c6091524990654dece6f494237324378ccf26059071d662c1b2b882e0128d967fc22aa493bf1ea307c2cec39db43989f0c9bad8c442d36af5d430bd69dbfbfa9be7e29fd68a343a7c71d53cf697922e0a383f7cd4e77d44b81607bd443251e608be3c6ee6d1dfeef4b223fd8ef9f48bfce06cdec3e7ec9b50a77394f79d1e3167508fdf52bdef362b3cf1c1b0b70ce7d940f3937debc9f656369e2aa82ba6f5d2a0e2dccbd07f54daa546f018428d6a7f72fdd9babed44bb03496ec95ded3061da45123aa9d230e6b37755eec374d96963a83d71384cac4e00f525908f341978e99e58fd464c930231a3e0da0ef1cfb2404a020ae1afcd5c17a7930a0b7489b39c9cf9a2fe3d446121bf638b2828b5365aea8dce4d7c1c10719b70d9ba090e7521b0ddad604f6c5bf3e8c7e8a8bca304b22addf75e4eb32cba2a46435c19206e89813e9b6d6312bbd5d7c3325ac06da33dbcbc78d34975385a6df18d200a8ff5d61a492f9287e55be649a21850363ac2ba99dadd32d9cadbc901a4602779c4c3c90d1106a6917a25f4ecb67e9b472c05a2a71ddb7ed1687c193e701141f99f2309415ae68aa6c14ee5ff44bf691ad3a198567dcd92bdd5371f8c7664eda1c44d0a752639c46b67e360482a91a7284e5038bb8be2b7057730cf87079fd6da89f17f4cb5fd588b544d59c6372c6679fe3d49147ec56308f8efeb0f9e8621dc9d3ba05f49b9aab2d955bf22319d5cf75a0f76a73a21b930521e7bdbf174dcca896ab80ff3503f5d3a2ebc70fb261659908c017d3edb0286efca92b7db04e6b8a145aea7ce96600a26c737eed88cc23a5124830e1781abc36b2545f967f06424a133bc42d1457f28183397a3a038bf73834cf84663503cf8a3f0776e77a331299e26e564d306df2d0a3708a54b8fb3b008d16f76996523ed40c76900c3542e4ae0ea73cc94867eb2892f996cfdd99a74ea42a6f10ea95e5ef242bf51d387e4777b5f955f44eadb819d10594f5555f436518243c85154b89e10725aa987a4639a3ec36936b0b7b1aa782affeb92031095482e00b87484b9e7f0b7a74c70c9e6c5d7284b76e13bdd5856a3445a1122bf0884846b7dfae5a6ff7ddc9f1dfb9f8a8d69244488e1e3f3ea270595d1cab4f9a623fd12f5813bacdb9b4b13d2117a6a2fc27a2a6a7a8517a589116e8391d9f6a67af19fb0a2a0362d563e6ecae8d3f14bfdedb17ca115cef0249ce4b9849029295b0c2e3a112ec19b3899cf187d6a31cdf8a4fdc5e3c39fa954a7e94f57106fe43e5051b35c31458249c4514ef8a798e42e92529e1206c83699269f3c431e149bfe2e97303577cff3fae39d8afa2de41a6ac05cf020a12143bad89c516a23ce2f4a35e9602c87c4966d56220dbf7cdfc90a2a9f64cef7f622c4055f111822eb9f9fe16a77022f891a1681697ffce40cbfc8516f6b9f0f3b7b26d6b6ebfbd9d4ba676f7ec93483e9b29f662fbabefec473459ef981b7cf410ed2de24b9afa2b7c8dda1dfc06b98e97b2af68c9d61918f73a7a339c8e2d9b6f118f5115afe77f4586d1b9e993fdd8e008574210d19b3b693e21b50e97a5d631f730560a06835db4b4b6494ebae5a46210ea078d63e515ab284130c218a407c0bb9f51aca4e83c3d24a0a123ca0f65a8f63f75fb4444dc90129ed081049bc3b7c4971a339cbbae1fa08a1907a2fbdda336bef10073cb742b5cfaa717885b4afe82792874dc3b9a177675306c0505da9c54422470404ab5d6c562f9acc66fbb4dedd760b7d8d633cd89a79a138c9f2e536ea3d161265366dcc7a13ae0f0d80e21249bffe57599758f7027f526e04fd6e2dcde6288a73e0514009fcbec3a4100586d2f8a58510a335260599574ae6606d61813d87ac5e133cf69c36e890781d4361962ad22e908236d791a85bbe5dacc1a7b8c0318214e53dcb70a8827fd51d25d4b3c9ce322fd8cc4b184d994bcf115cd0fc12136c3fe2c3447f8ffd76cfa2446d369472438b27f77eaf97089d5d272c0746ddc72c34a8b3865c64748cb1b8abd390d28ae19e4ae43402c9adbac08fe991baa84c8c1dbcf6dfd7ba2e318ffebe0ec04098a49755d09db1fdd48297475fd881e6ab04a805779a1c6518fa83e006fe6d2d719e14648f8bbca7e2f70dbc8e0e933eb4f41526476b6afd17b34f92397e6d8979593089d26beb1143d376dd74dcf5d73af8754db1b3b75f7f731f263119065a3792be320f9b85f35cdb5b78b672ecf4f65501e07c3f50a4fe2642dc932166e05e9fcf49a2dcd7f6bdfab0013769e30faacf02ad320f290103eabd8927f87e7fbc3d5be99fa52aff61c6f3becfc53ad3848d30f45c01da01df410b10203fbf10dbc30ef7bb90e65f50591fb91d6f53b321e3e50aab9f11e96ffb670428450c6828c5a438f110a1eb0db46a4fc93147c1dfa4a544ded64f53a31818339f6c972b58a4c1f90832446ca5cc9bd61fbcaf4916c705e20864a0ce1f6ed3035319dd9ca0e9987bd7c1943ea1c9f0de6f6af5ccd1b5dbed75b978c4c82cb34938c780367880aef710401d0b67477119c5a55d7d80a600734f92165c89c99816b5ac7f7d250ea216b51906be2fcfd0b8fb753b4d5e4c3e1b9e55bb20cfc3d7004793e8e87273b84eb906b8f1edb82928137d6e8d02c3d63d061cf085f5bb7ba2137119e156f4666b94348e8b7f08e81bb6e5dea70a201dad39a9a1e9b315d70945a2bde0689530762a519b215cb5b16871a16d36bd29d64bfe47d7ceefd876531ab39a25e1c2661bd24d476d97bd9828bbe1053dea3daae1f461c9246ad2c190247cfb16040f7d619ff723d89f722965048b7eba878897853d77c231e3756ed0434651118c91fefd50a7fba96b6c95ff1aa9e794c8e5824bf2243608cb63829cb2004d70ae7000c0117873167f88bcacdae37fccc2864da5d6f80a3b4cf7362f1895e5f62217fbd111018feaef2110e7ff47831a71cd0429b0c18e2fb8a3afd7a768a2aceb72b0cda75afd9e17cd70550eeac2adec87aa0faa23f3c0b52d5a52a67106d7d6434da8a8f13e34696c88f08f095854d9dc42181f4b93fdfe8e3f1934bd300649b8622d38bf9cfeb50e8e9d7c2297a4456a75acb57b069957af924499e891cbc68c737918d64e95b9afe9adcd0db334f4f46f982b0b4e4b585546b0113a50b16b46274a872f512afb5e9191556f508f934503d97369f8f3299a824994c39c4a7d8680532623c7228af32e8c4f970982f561ac9a9c72916b94c270be341702005a7d2e836c940f33bd25a35bce09c21d1543b4ef9660cc262e87cc5c09721ec871948f55d81b64a007d8cd55ebc7df0ccd27fa0435b1cfaf59b22473f1cce434041a48dbeb44f02fe9a9821f42ad258462b7502677101fc5cadb06b92c8f214b3e8b8eba4fb72f6b0826472ff803fe978de6c68d3abf5db80df1834e9cfe867d538bf2f7312609b3bddf373a9e600a9e5277d40072f3d06cc29c1ed621651b1a27fda93ea36e7ce45170d7b5c1f865948facc97996095c344135420d2ed6ef0a396b5003dca986bd543070fd95efe15ae188e350e429091440c267d734134fb914c3bb3e2b1e9b55b8eb0303eaf1fa597443d28eab0de2a70b0156493fd9ccfb555b8d8ed7e3e029193cfb2caf3944ec4e055f12f525c87a168eb5c7c8c91fd62c92b554d6ca496ba847ecc0d7882c96510919bccdaa4d482576b900ac4cd95baebc255abc316b3b0befa14f1de961ad2996663b00215dbb836c36442f801dd3f4738771aefa269f4e8777e1acac5be3c17c2155a259f26c523e456fb5edfa20bf89c7d78ecaaa3cd92ee972862009084a67a5a3c8bf55c2676db6eea3411ce60103357b5b7091f82a42e12db0e402f791c20d5352a72f2211abc37e36d8d04bd7dd45627ac44db5a0da35d116873bb8e67b737f5f7097854b9359a5bad5f62b1353a62c008127ce22df5fe409dbc785239a6060a931a7f3055b2f9cec8ccdc0e5e7cceb54e993ac46f4af1346e30ec1efc4f3a89a262f488e5fed1c56fffab032754fe6425650b3c8b8201b272948b31b306c28cedfbd73063a81718473c2aa2ce16c4fd084dcd83b43f2f8a7b5cfdecd4b56b1cd4dad0ffd7cade5661ff9cc2a4819c2df0f651ae126b7f44df1ad3327b9631de27b1045270ad38153bb64cd7850c2097116fa0a452f94212794eab748b98e0d995e69f3ff0d92db4f6a640d12833390f8c8df3f6bf97cf98bd8c58f9d5139bc8b7b365cc330fc0dbcd22f3173208c5d1a8202275868cbcb8235605e22ae6a7021c88c5ba72418d2cf9cf48f34d962b4a56924455472ddf815b57458a2e754291fe0edea5a31a5814914e5ef82dcc913cf2625f963dd00f19552115d6dbf6152f4a11de4e198f1ddfa35fd382d4fc8d04210e38388ff5d830c484aec3915c6240f5b6a9186308f642e76e26d76d66e97476a35765e093e7c738edd46fdff60074dc33be7d9919d22d274a1253a4ada2e95bd76b63cf8a94d1ebb0c37c1796b0ef8a7797ba996fe80cd6dc7d9d5ed0e39e83bd6b89d13dbbb098041c5d6920d9fb3ce5f1f70fe30406e00f099736e044a4ef48975e3a05cb0b4a1178da378ce33b2568462ab923d9c89a9bcba0324d2e8a6b21a84e44b1298aa08c5f0bda4863ea70cfe64659dd871b97c562fd7fa75f94acc05658a80a6af02d8a54ee6ea8d3b63fb2b9bb31b61713922ab755be852bf99a1d9183d4b6f66755c0c87b180202bbaee584795375b47ca65adf92aa311dc274266bebf276a085525eed3a3a0cf2840e9a62f26d2a5085902636e3fdf41d6b537199d70e624894fe5fc05f7e73717d8ef5d3ac18da62af9415fc32ebaeab4e0d17f82dc88a4e415e13690ea3de36454c4f5f5161a05004d196b3ebd115fad55596b4233c9b225ba0610e30a4215cd1995aedcf32e85603edc2a7ea732d1ee2490969a6373f6d7f63defbdd4ca2fd187ebf486e29185b2c0be6d31c5bd4bad431771659963967b8e26ecd4736632b553c707319fb7dc66441ed64e418fadf745a117439409cf001694339ed965f80f57b4bff4631d6be61966e5c7c22a7b85f4433a87853004ed49feb248d69594ee3ad00eac4929491c48a49d7fb84ddd3aadcd15a0a050f2dd8d3ac3d09795233394a3ae1de2d7fa39a559b523bd16556481753f0a91f4dabacddd5", 0x1000}, {&(0x7f0000001640)="3f861b7932173df16677dae35d58ed2b0fb063dfee8b117d28f4b7d1a9ebd72801def660eb6511bce56af1a031963e0b30e358538587ef463ad01489805a45473456ef8cffaf182b33dd09c9c6397b968e95d374f1c0ce621a", 0x59}, {&(0x7f00000016c0)="c13286e174a1fa16078702c00a6c95ca75319f8bef8c59f0e92317f9beea46ddce63ebb20cc4444cc931b0c87f453e955f0c2b171902ae13a8f94457b72d5f695e4acd05f2f61c5a4c09831c44a3d01073db70ceda03703d12aa394cfce208730e48930906e3dec78a5e629b2dc8e96f6b8b56db98e3ba04564e2e76bc1f3250e955b243e7c8447ac217b4e88d2ac59d35aabcb1d8e7e0f9a0928ae8976fd024a98ac0e4a41c96fad10e215f36613ed6952b6eea843921380bb5ebf3e8cdcc9aacd870f02dcb5f496468de8631a49b12b13c960946c3521cccd757885d6bbc508e6cd04afdb5f2f2b577f51997c0603a", 0xf0}, {&(0x7f00000017c0)="3a649faa6126d6bd7a74c7db688a26b8ee080b24c8489dd9a9c5c945a4edf41e358cc2af110e34508d0e4bcaa93383d47ec134d9a84f3b84b749c2bbdc91b93401ade21ada01ec6e4beadbe6a0a390b04d74eb9b090177", 0x57}, {&(0x7f0000001840)="ba1a221048befa23d43f25c3f340c28ac307ae0b502712ccf381308681d352a729edef462aa368c3db1555dee4f59c03e5ab573db2c1ba06ee202a776f4aab3c21601fb4ce6dac235c2255eefb5751d88e9409d722401b32cd622bf9e7c460a6f9063e8025ad679d0460c9a3496122ae0b0129fa2395c83967e72122cf488084ac581671a75d4ec3d8a730a46e6deeb40a78474fbab5e93d7f0e8dfeaa04d72bf8c058a2ca3e36a045cd45e35e", 0xad}], 0x8) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a3000f500002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x107) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getflags(r2, 0xb) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000400000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060002004e210000080007400000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e21007d250c49004e24000008000200e000000234000315b0c313004e230000060002004e2400000600013a4e200000060002004e200000060002004e230000060001004e200000140004000000000000000000000000000000000008000200ac1414aa140005000000000000000000000000000000ff"], 0x1e8}, 0x1, 0x0, 0x0, 0x4004880}, 0x4004000) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2cb43, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x8000000000000001, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000440)={r0, 0x0, {0x0, 0x0, 0x0, 0xe08, 0xfff, 0x0, 0x0, 0x2, 0x1c, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c40600220000000000c594b1b3d741dd17c18e9438ef2a565ef1e83323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e01008e164f000000000000007f02000000000800"}}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) executing program 34: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) executing program 5: syz_open_dev$evdev(0x0, 0x20000000000, 0x840) r0 = socket(0x10, 0x803, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000001000/0x4000)=nil) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000080)=""/108, 0x6c}, {&(0x7f0000000540)=""/35, 0x23}], 0x2, 0xa3, 0xd) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)={0x20, 0x0, 0x1, 0x70bd2a, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x6e}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f00000006c0)=""/118, 0x76}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000001fc0)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) syz_io_uring_setup(0x228, 0x0, 0x0, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) close(0xffffffffffffffff) executing program 5: landlock_create_ruleset(&(0x7f00000002c0)={0x1}, 0x30, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000005200010003000000000000000a0000000c00", @ANYRES32=r0], 0x20}}, 0x0) capset(&(0x7f0000000480)={0x20071026}, &(0x7f00000004c0)={0x0, 0x3, 0xfffffffb, 0x800, 0x4, 0x8}) fsopen(0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000480)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000009c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x100007, 0x1, 0xf06, 0x3, 0xb4, 0x80, 0x9}, 0x9c) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000140)={0x40, 0x40, 0x9, 0xff, 0x1, 0xe6, 0x8, 0x80, 0x1, 0x0, 0x81, 0x7f, 0xf8, 0x20}, 0xe) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000001c0)={0x3, 0x3, {}, {0xee01}, 0x8}) quotactl_fd$Q_GETNEXTQUOTA(r4, 0xffffffff80000900, r5, &(0x7f0000000200)) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)=0xf, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x6, 0x1, 0x1, 0x4001}]}, 0x10) splice(r3, 0x0, r1, 0x0, 0x20000000000002, 0x2) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) writev(r6, &(0x7f0000000480), 0x100000000000003e) ioctl$PIO_UNIMAPCLR(r6, 0x4b68, 0x0) executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffd, 0x6, 0xb, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="800400001900", 0x0, 0x0, 0x10010, 0xfffbffff, 0x0}) write$tun(r2, &(0x7f0000000400)=ANY=[], 0xa2) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000016c0)=""/4071, 0xfe7}, {&(0x7f0000000140)=""/32, 0x20}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f00000015c0)=""/191, 0xbf}, {&(0x7f0000000180)=""/26, 0x1a}], 0x5}, 0x7fff}], 0x1, 0x12, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x80400, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r8, 0xc02064b9, &(0x7f0000000180)={&(0x7f0000000400), &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2e, r9}) r10 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r6, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0x2000, &(0x7f0000bdb000/0x2000)=nil, 0x0, r10}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd0196db0af38f2665cbbb4e66534143d02eac997657cf0a3df3cc8df5281ca813b255039632532f021a46b78fb7892513e4d3307f2dc6eca9986be03dfdd7dea5a59b3af0f59c39d0edaaf273933db78b8653e664f28ca6a3f8803662958348e8bef4a1370e5fc0c803eeb3e1", 0xb7}, {&(0x7f0000000700)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16", 0x6a}], 0x2}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129d", 0x60}, {&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af84202254eadfd12b56f2ebc32396500466e9f16d358dd5354ef69bb8caedf66a220372311a092a4f03a336f27222302c6364b738a58c3b8e99d1a40552dfad46ba272544c0b39ebbca7d1da95fc74f6010956a8bb3165ee8db3867d1f92176de044693fa090b97bcadedd59b7e509e0d60017b6a3b025aac6650826d7f3406d4206b4d714c620225b5797e60513988e244874ac2a0ac80d18c707edf4999d1beaf841f2b8dd9a3da66e193ef2ab6ddba5185b5fd322187b4ff2f9677ecd725eaf86412158b744e32abb8ee3c039cce34f129d6f2665630931a5e03fc6984278e20e320318b0aa676822c2f732337cc75a858a07ed8c17b323d52ee421e79cff1800d1da3f311699f5eb8792f6d67c035ea9348f7f6ff81b9143db4742618e5ffbe48865d787e0a31f8e4d9e7895eb15c36ba4a81355080818efd3cd792293ec3e8cdc577f5c42abbb74331b352f17772ea7cdab8bb640b11db772baa4b32069b99e4cc43118257afa84eff7c8eb2c585da8e8e76404312b55db433c7365a866bc2a678f4817ba7b0838d63eaca429ce563fe8adfe7f114a941f629017d6f0ae80d2c0952ff5550bf361bda46eca47e1c271e0241d60290b9f8e1261b447ad0ba09fab7881291f7c2792537e7a5948eaba0235472406903f1d7095800da3aeb07e914868f2e75208b7354bd8118e91f1a8324c2dac24d633bedadd5b1fa6f2a2df302b7c7516f7f87fe570807fb205b287da3f3a1d4f66cade6cf61922cfa0f23212e282e260655a1d7dffd3be5e2c87ed16b6132de36d46240b76e0ae38e9ba2ba8655672a994adb8f3c4f898716f28fb2ad1272dd8e023463620b33f26ba1fc920cd0c4988d906204c63b4e419b376d858a5102d1e6b7a6a64407c96a841de8884dc0a87f6b93155893a6a6e96786eacf7ade1d81bc0a41812792b6ca7788570c88434a9386acde275f9f89c9cccf1a7e78b7bd695e3d2bf79dedd36862838263ba190b4c6dbe3ea6ce7ca56be38830bc8565f38a6c3d5d12fb92b61cab69af17ee94a0d5438eb96a566aaa3a621d2f8f34d7273cae47adfcf233061beaa7ce9fa34f4fb46528ca1c819d0068d82a7bb3a900eae9d8237eb694cef5df200b548c8fb87f1523281865d40c652efa2f014df7218e85579970ffdadb67bf0c71e961f19ced3c84ac568e6f2b9241b00444fa5b052d28a6cb872e7d7e6d025707729dcf510683462e61eddd91799ab3a18b8fdb04c6", 0x3e2}], 0x2}}], 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@private0, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f00000006c0)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000008c0)={0xfffffffd, 0x80000001, {0xffffffffffffffff}, {0xee01}, 0xffffffffffffffff, 0x4}) fstat(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000640)='./file0\x00', &(0x7f0000000680), 0x21004, &(0x7f0000000a40)={'trans=unix,', {[{@directio}, {@cachetag={'cachetag', 0x3d, '[,-:%.&'}}, {@cache_none}], [{@fowner_gt={'fowner>', r11}}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@dont_hash}, {@flag='ro'}, {@fsname={'fsname', 0x3d, '-!\''}}, {@fowner_gt={'fowner>', r12}}, {@fowner_eq={'fowner', 0x3d, r13}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@obj_role={'obj_role', 0x3d, '}'}}, {@obj_role={'obj_role', 0x3d, '/dev/sg#\x00'}}]}}) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="5800000002060303000000000000000000000000050001000700000013000300686173683a6e65742c696661dc8300000c0007804e4d9d3e000000000905000500020000000500040000000000cf4def687afca92e3f224e416b980fe4020babe36d93b4cb40b181ff5c5157224ba926f5862fd8f4ae37b9c8dae407dc0d34dc55b464e4d4bef9096dfe8cd2073a67be1f17fc320aa3037aae81a1a3185d9aa7b99d2c74c0e10615b2c40d7d088461182fc1ccdda55c00b524d23af1c8080309923ca4d71f31b78da03d61ded4017e5c5e2c56457817850062410715184535f4c583c94bdaf9840e48fae97ac3efeedc7b176d86de36e90e645777b456229a71bc9cb8f685e39decc90fe8d563dde1e6c6bc529dab921428a48a9b0e600072ae2282d71a6fe316add28de8a2688562ea4240ffb333d1c877abb5ca699e61ca21f6145d57b511c3cc1a77505bf2fb2e597c888cb8b933fd7cf8aed524bb8420e2a289482941d3b5537ab9f2c889e90927b75718960bfdca174a28ba7ba31d746fe4a4466bce57a48664b80cd5ac5b71"], 0x58}}, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r5, 0xc0389423, &(0x7f0000000140)={0x5, 0x0, [0x90c3, 0x1, 0xd, 0x2], &(0x7f00000000c0)}) executing program 5: timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f0000000a40)='./file0\x00') syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000240)=[@request_death={0x400c6313, 0x200000}], 0x0, 0x1000000, 0x0}) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) timer_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}}, &(0x7f0000000100)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r6) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r7 = syz_open_procfs(r5, &(0x7f0000000040)='ns\x00') syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef0109021200"], 0x0) readlinkat(r7, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000440)=""/163, 0xa3) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r8) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="2309fefffffffcffffff0100000005000700000000000800090000000000060002000100000008000a0004000100080017"], 0x3c}}, 0x4000000) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x80010, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) executing program 35: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="0f01c9c403e15fb1000000000026f247ab0f2052f2ad0f20e035004000000f22e02e45ff9e0c000000c443050295000000000f48b8e4000000000000000f23c00f21f83503000c000f23f8b8010000000f01d9", 0x53}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$kcm(0x23, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r0], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) executing program 2: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000001ac0)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000240)='./file0/../file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, 0x0) executing program 2: r0 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000280)="42f2d226dfbf55c6ebc9d4ba14698c2ec0416b3cb15f0b947b9e046bd3c42dcc8b201664bd37d5e1dcb2f64ec074a225ac13a89be79e2bd5bdcd8cffc5ee0512dfe666423022c73264aee90673292872b9ed8e53787dcf53322f00", 0xfffff, r0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) executing program 2: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) executing program 36: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(r0, 0x0) syz_usb_disconnect(0xffffffffffffffff) readv(r1, &(0x7f0000000800), 0x0) futex(0x0, 0x207, 0x4, 0x0, 0x0, 0x1) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000740)='team_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000014c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2, 0xfffc, 0xe652, 0x2, 0x85, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0xff80, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) executing program 6: r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200) syz_usb_disconnect(r1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000800)={0x24, &(0x7f0000000540)={0x20, 0xc, 0x4, "d4fea164"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 6: openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x1) executing program 6: r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000840)={0x1, 0x0, [{0x48c, 0x0, 0x4}]}) executing program 6: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) executing program 37: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000280)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000140)=""/248, 0xf8}], 0x1, 0x0, 0x0, 0xf5ffffff}, 0x10000) sendmsg$tipc(r0, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) executing program 7: syz_open_dev$evdev(0x0, 0x20000000000, 0x840) r0 = socket(0x10, 0x803, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000001000/0x4000)=nil) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000080)=""/108, 0x6c}, {&(0x7f0000000540)=""/35, 0x23}], 0x2, 0xa3, 0xd) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)={0x20, 0x0, 0x1, 0x70bd2a, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x20d3, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f00000006c0)=""/118, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x53}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000001fc0)=""/191, 0xffffffffffffff52, 0x500}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 7: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000002c0), &(0x7f0000000340)=0x4) r2 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)="48000000140081fb7059ae08060c040002ff0f03f1cd823010a7ce9000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a0200000046", 0x48}], 0x1}, 0x4000000) r4 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r5 = dup(r4) write$binfmt_elf32(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c464a030103ff0700000000000002000300040000003e03000038000000d600000097700000fe03200001000700080007000000000003"], 0x58) execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r5, 0x110, 0x5, &(0x7f00000001c0)=[0x4, 0x2], 0x2) syz_usb_connect$lan78xx(0x6, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0xfffffffffffffeab, &(0x7f0000000100)=[{&(0x7f0000000380)="6a44f1d6f6a697494db6c99178c0bf2d9875a672d60d559c1a5b185abb784d0395bc54976639ff16ee9697bd4b98cba5196ff2198eee6aa716b8230cd26d4d15dc8d144a25ca2071808fa35483f18ec26b26d05a7f468ee86e8759e4382afb69ee1205226af85ce1cacc5ad82a5f79fb2e858c8427b4d350ee8f65797a33d58ed42904747ce473655e939b3d07f55f94e09de425da3a77c990c6ddb8b579b65dea67099f821ace57015bb955e2030880e809185768e1bd77f4c3257fbe8b145a6f2e821138431601abb929af2000903fe2a8815339ab0746af341794441f931a64f5156f92c32d8ce3455b3833e0823adb7a88acdc4fabccc4384adde42b776508b995899ae8829f481e64865db3fde9a59db01a0fba1340f37943ac5386cdeb948cfc5b763f303843b6dfed2134c4b90163902222ba0a413cc95458789d02ab2c98d2bb20dfbba952455c74e41672e7f611043b4ef5ceecda800ba89a0ff583b333913bbe9b1cabde7d61e07cd95b4ba9ac6cfceca36771a645bbce65dc8b4031ee05624821328dada50972f203fe9452a7bdf892f465dbcc06d254ef7c875488a8a0461fd20116b19099915fb8215a88758ae818071442b4917c5e993ff4d8a6c52086837e822347087a815a6dfa755668c02f79e35f6c2a07b10282c92fd3dccb18eeb1a4cbff8d9e625d9d84ac085b6f50e7f90240d0527f8ec2381168865126cc7b0f528d8bbe5fb11b7bf908d300c4af70bda57f4410d13e7e52dc277f8b2bc1300f766e39dcb53c451aa66d22dcc770f846840c2c9397ef5b6129c7216a57f843e206a79a095c890364ddef6bf9b73286a34360191d1d313b0d07a2dc2be8e7fae2e53e1ca3a31284695a3d8ef95aa5674814383706f6d81c59caddf107fd44d336ecba55083e0306663082a4af24089451b3c94846d0b2dce03f18db2267f1e3c3b366e66b6f5b55467d3ff37a5903208caeba6f9d0b75d1bb5b22106c8d98f5e175e9de0e0f6aa6bd133b235d3349473b57ce70b3ac81f4b52ffbce9f5adc3c14ed49be00c645b9f8e25d0f71c1f0f328286e5bc56a5618d654e19670640ed202c75a412c0cd470c640915090697d345ccdc9824ee4de6fa68f53770182d6e8b4d3a72bfe3a805f7ee21b09270d7ffadc17bd1e6ef3498165aec1d217f23602bc7311ef72efd0223ce363a29cf203d4938ed26cd254396d2edb43f7258f40cc6f26e3a93882a38fee0bf0487adc02f6b5f6263295e650650b3646d11af5b51ca7794d7bede6e3f9511d84de549820678e402df61f5d977ba469dcaf3d82df28730d5c1b8ea24596f253260fec27a340d8919f40667718f6653b01f3260b94c1bba95998edffecf1ab17a6cbbdd98a849949e69023c9ddcf8349536d11629592696de57b16bd1f73f7b3c44e765c536e307ac915c5d21a34367f36e6b8120710c52a3e20ec5efcb6d0f8ae6a0cfb4d27da16090ed3a86a6eb0ba183816b0ef00b3dff1108ac86538dca104a9dfc1b250cb1440d132b03c0328aeb6f8d53ffb309fa7164abcd051e60511b71c4168d92f05fc43636e00b20934a469b4c9686d1326211991cb846fb46736ae43bcd500fe72ef6bf47b7600f56b158a7c733b0c126d233002e7d22c6b0c795822988aeefca0b4a5e013dd424522193fee354cdb036e35db3752a860fb5993d5d6667008836bd4277939bfdd539e952f52f8d322852517ae43e479fc8150a2c9fb4dcb73ddd5f3e0608fc51c45bb8808adc902adc071539fefce27d0440005ed039119f6e74532b62b4cc89900b30f8ee7b5683f162197603485212760b27572b03fbb3293be7f9adc2b6130b711f3091bf7a4f02f9cc3f4181d3d4f2781ecde756b5ff82b578150a4bd0cbd1b68d870a304bcfdc73d15d24198786934e585be27b9c63224590e03dcb413e8283be7a82781503adbf75f3d6f6f43717849c5f5f91e469dcae1f0a36875aaf31643baaeafc692bdb4d2191a692efbd57fd8871eb289f336e9292a429ef630539219cd4b7015cf8daa6fb1a418d0e4ff7f2886bbdbe039206f9241a1ad8c8b168ed69d8afa66a73d78a94f7e5ffcdc4ecb5f8edda92ffbcad77b4c49442a35de07b89774e4f103e81b57236fce4773be6d623f675c45ea6a3b009f49be4c66a274aeddb52b8571426af4a14d44cd915f8b53da1f7b0e58a817a8c1d7c7ac9d178d9cb46998bcd47cee3d181887db1753dbcfb7bfc6f482298a78835318e2fb0dd270d559efd801f261983cfd6661dc7fb4ce2c26e600572b2e41072b9713b2aca0b41b6b7639c0d6f84e972eef3bb1c9b921ea51b423cf7715f1016d1118d9b1213361fe0ba90e4650aad2012e31dbe2d0b748648d7179e288c913eb4d1a6bfffd2e8e80f4f28523d5904075ff6e481759a3d1ea8cd8eeff92a6b314131883ed3423913b84434e4d4690abd36d32fc407dc585e047cf66a6af671443f9d5fcd2bae0ea0b51e53c0d38fbac4f301656a0eb8010b90d6fdfff88cffc0483ab89b8e186a22e9da921edd870dcd69c66ac61fc0783b31c9c8ef4ad3f1b1b8704aae4fd21822d174f30dece2f5605bc40a81f682f65afb7642fb252e21e78a84cf75c0e64d86589c9a1429add1873223fb2400dd85ed8ea09cee938934f67492ffadc32c45d14dc4f406e4dc5a13cb0b93b135f1626ccab316c549578e9745a516b69daad2a05495814fe14d8e61a8b4e6701330d11d76a6ba2399ed2fa76be3aeef64ba828ec694a6f40209e9b5483c5849fe483ecb539ba25a97ce4941c2912577153404bf96bdc13caf7f1e422845689fc37fa198b59cbe0192e3634144817251284387335a7d98c1b78c9827e71f5ab7caa42ff9c95441b2537633d4a46606ae8bab9cb81cfdcfc8a6f3a7414d467ab08e168427d0fd6c9917f1a128a63287d3b3899927e19c3d9069efcbd7b18635375448bfe2c5c1219085a1a789b2ff11fafd7ffa349a0ba4c4a097551ecc01c0b65bf4ecb34ab7333dc433926d6bf88e226efea8d8a5d5b4b39dedae19334db8e862f0de3d82234f758160f9d69e84ed0c9af137fbf8880ae5a92ae91705071a44738926cf1f9cb819e77982cfffc875b3a71086701af6b5e03d1dacf60d89ab9a2c578cf0fedc1759d8127c933683672245300ef62effa911df814128457dbdb11923d92ff1c3a5429bcf95ff53b5e08ab2f99f82435671131c30038624524faf6cacc9d01a620bc15e48bb5d098dcf4a9ab38c2f38e1a68f0b678d83db88e78c38c8ba3585abddc8f31224f872d5855df2c72a3c7c15d2410212bed80bc5f68fa00bd79d94d8069896eb240b65114350d562e974f11982052030669a8b186910b30e8b9b0b880bad51a0679d4984ad5edec617c68ddcd610b4d1f10c33d6ceade2e729ea926eb50f978faf66898dfc08ba7b23afa275313c6876d1459aa916e38f914c23624b733013cb02739bd48ceb3ac10f8f5ba9a0e1b7b8f0b4f3eaec76912d0e0510a7e5596972142198fd277ec66228cab5e2d2fc263236379eca449d13a7acc9a945b4e2695e1896cd5c344b6bebc42dc5831396901a213eb44a25f3bb94170628fd7a0af03bd77f69c331a469ff2b9064b1560dcb380e038961c7cd82c97eefbadb3c4e4d44a94024f10ffcb04d8840f356e88d3811644d3deb7548cd945fdfd92a2775347563f3597e172ed3273f220b3da9ce252f131b1abfc91e04f56ca2c942cbe58b54150af091b6f4cc4fc6a888db50a290f8f1b4e3c4452b6552ede8c3fa75ee0255fa973ebbaa82278c1f1b86d00f2eef635750ecceb550417a5de960d415c6de0ff09434aca4145389c5e63f171023c778e9ce756c9ae8d027745a469ed775155a265cbd721d5b653a05a3dad56b7337178b476f51e59a7f94afbafe0568546d2008d4cc8bd6df8e4ba3a541b42b6e1d52652dade7a0b7c492bae3ba8d9cfb0012ea10f72a0ddd043204320ceeddb728ad31e4f9156d5e0be6e02a6c7c1b3e2047cb3486e0940d0d91bfadef53fd1bcf9e7cfecdd2b21910897d8a149899744cce00c8031e6638425d26a3265a4d33b547fb8855a92d83cbad07598416ff0816d07c2c98ea0a53c19124a5947fc1d74d08d7f093e82dffbd86754c44669443c4c5f1648a692237f29f9f59fea64b7800c13df65d354b4a9e0f19b3e38d78960a136ecc62302f9ab32aef5ef2f2e9360744aa8bac9dcd5712ef14d17e4ac461d42f16335312bb79aef7fe02371caf9c4706565a338c2000329f24a8029fd4f302d67e14c56b5a9005934452302f41c0cb4e65937dd36f5660da7f05e0c4e43f291fc601022ad2db78d412168d6b6f54b400c7de0be3a09f0a123724e9e23847293ccecae2209433c034b1a60d3f784160667f6a0edb7da7b4ba5b68e3a4466679d8254a5af21e2df4e4b7330d283f299e7dfcb502391211cc59635f90a0653d6f9cb7555b875d8772f73d6c0aea14ca3014e4058e60b79d1d4070df80c0be1f2bf6490ce193d4de3d45d778933ce3dc5529132f4fffb1ffdc526f6884261b7fed64c4877474541e71dd2124e19d4b9dc51d2e898c2b5e24902fddb891ced8649a2c5f9b1d63928996d9879dbcdefd556ac5e3fa07984e20cc8ce0b20cacfab1f241ad9515de0e578c41aaab8801beb4566a276ad38abbac0a638ca52655e62fd0cbd2aa4011e7c2d036b0be2cf0f8bbb812ee3b7dad03b302fd2e58a564e084aeda6d8550293f05d91fb611fa45656f5eb4843e1cc7bb03d86fefafbb7593e561693b3bf5d5ab0bf3585fad1d0f0263b8ef05d331fbb9d2b0bfc861b09a233f4c789ef3ef00061653d09b703e7e578dea9171b07ab8d5597e6311a9e8161835020b597af6227db52edcee60337dec7dad98e516dfa3bcf567aacfec012ca130aa65e1164da627f45d02f595b2c159c0c7e8fd1a20a1f82fcb7926b53be095626e4149c763868f1fb5b4c562286396256d721ce3834b5350101c15dc045112b22b6c2a6e6329d030b05be6ef5848250b832047faca61289c56a5f59e28f0a7b8d7b526899b03157ec6f9b27fa80f9bfd647b478f480d78faa1f5183ef8e162cceace46314e2916b2aaf10f557554f1279b05349101702961a4fdb7c8a1df387835dcc959997767b0971cb22fdf0d365f33c70ca90f653c1bd6726e3072014e3b737ef007fe04d722b6d2c655dd2feed74004569ad78faf00388af5756276b580caa96c53d10eeca58e20192ee96057889b8175684673ca326f8a35c20489d45655d2e33008edc1b1ea1eedcd1440564faea72ae34f5fc7f44db0529646180ec95d8f4e48918e397b26f8e5219f50bad5775256d8382b13ac6036944632e672b21bb67efe8768199095e784b908e83d77db3e9b7a6e1519bc932fc46b0563c8126047b7cc7f2e8f9a6977dae72b748e6cd6063eb2b4e927a59e94a2544e80742619b41664f2da970fc43992d50df646dd92ceb84dd98c59d34f8ba30c026006f379389a5a6f0fc7a5b35f993fca50939ed26d37acd44513621423c1e875c52d072b06614ccae7281c4287309b216abcf64e51aa6da501b7da2fd52b6bbabda49db1ad99a6b40695781fee9cffbad7e614355ee7892b9c02c5057dcfd4947d45b8e1c6bd6b3df17fcd8abf2742d106ed8d355ba6152bb2c08261b280ae57478f92b83d9b09f345761bc4d93091149da5e96adf3fb90176d7b7de38a2cd47b795bcd0c0cd4cfaa5d042794e96c7c41f54205af0cd5ea2346d814b55d395e5ba28d7ddcc44d910860966bf88b5773c5"}, {&(0x7f0000001380)="b5d51e87e674e4b13902d16d7c0d6fcbe1fdda2394408ed5a63f6dac7d4a5e19826a799a0462aa72bea05972620a86239bd2d2b77a9cd0a3f266afb44277b9a13b13364bb87ac2e4bb8fdc22072196b5408f6c2afe9c3da6bd6a369e801b291826295a95a33e1da016ac6397c843797b49492e896bbc462cb2f3a90c0bbe53f92e63e9b26ed783a75d7a74ecef3402be10ea870f0834ca9d1c7adaed1dadc798ffe7fccc06a0d464ff8ffa9442f4260fc2563a41a02e5775528085dce461ecfa70ed87289a255ae96ca5e9307da1e7082d73310b7ee1c65d7f7678c3daf30213e563903b0b4d84fccaf10ab519875ba033e30d63c63e647a02912e7e63bf9c"}, {&(0x7f0000001480)="f8438e88a5727122f0b9f3b28920f3995f366a7d26543f8c1cc6782965e4f04f805cd5ce06923eeba29b13a86b19817152f01c9e6b09eb0931e8f53988390c5378b3081665029f391706f1c49dbd1db8da2834b22159616a02946beeeef6182bbbbbbd79f627f0e3ae1fa6c37cc5598d78873f143b603943fc42fc351ca567ce26c74e09f03fe7e2b3d00d"}, {&(0x7f0000001540)="83d309daaee832b9a1f17719f5292128918ab8cc603f560cd93a013640ee1f78fe14b4ab3e8865fdd70841103f12580b2a69308b5d1dd155c7093c31b72d3c06d30b58c791f2a759d33ba196aedee53cf6a505eaccaa321d3a7cbfc09736821f7fbb166f53082630ef3f1f1b24f25ab05b9435c990ce6580a20c76a2f65deb1f51a02b2d9bef45f3057a33399351483614ee2976a3e6fb0ade6c61973fd3f772f0c51e2abad9f69b7cab67e49156ae1b26565c7636f5b2206625678c8a83b764fd59e581149f815e8ef7acdcf939c353933b3fc09d19635a5c32d77ea1dab9d0f3f34f4ffb4c4e"}], 0x0, 0x0, 0x0, 0x1f00c00e}, 0x9081) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) socket$netlink(0x10, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x50040, &(0x7f0000000540)={0x11, 0xc, r3, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x14) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_DESTROY(r7, 0x5502) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xe, &(0x7f0000000300), 0x4) sendmsg$NL802154_CMD_NEW_SEC_DEV(r6, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a80)={0x24, r5, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x18) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) syz_usb_connect(0x2, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x52, 0x15, 0x5d, 0x40, 0x733, 0x1314, 0x16cc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x1, 0x40, 0x7, 0xa0, 0xe, "", [{{0x9, 0x4, 0x3b, 0x9, 0x5, 0xc6, 0xc8, 0xf0, 0xc, [], [{{0x9, 0x5, 0x80, 0x10, 0x8, 0x9, 0x40, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0x3}]}}, {{0x9, 0x5, 0x5, 0x3, 0x400, 0xb, 0x1, 0x36}}, {{0x9, 0x5, 0xa, 0x3, 0x20, 0x0, 0x1, 0x2}}, {{0x9, 0x5, 0x4, 0x8, 0x200, 0x2, 0xff, 0xff}}, {{0x9, 0x5, 0x6, 0x0, 0x40, 0x7, 0x81, 0x4}}]}}]}}]}}, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001c40)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000140)=0x200000000) r3 = socket(0x10, 0x2, 0x0) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[]) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000000c0)=0x1) preadv2(r2, &(0x7f0000000000)=[{&(0x7f0000000200)=""/76, 0x4c}], 0x1, 0x0, 0x1000007e, 0x0) close_range(r1, 0xffffffffffffffff, 0x10000000000000) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_SETINTERFACE(r5, 0x80045510, &(0x7f0000000040)={0x65, 0x10005}) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000017a201fa54769fd02b3b92b3b0ee67b69df40a5ba2cafd021e9d2ffcb9e2c5e9c9222374fd6b3bc4ee70892d59a783766c84179124cb345f9c3a6b9e7aa806650731da0a6497ed1"], 0x14}, 0x1, 0x0, 0x0, 0x50}, 0x640480d0) executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @random="008000"}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x0, 0xc}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x30, 0x65, 0x0, 0xb, 0x67, 0x0, @rand_addr=0x64010102, @broadcast}, "2197704658f37cc5bfed5bbe29edc3be0c0dad392d66248a60dafe72"}}, 0x3e) executing program 4: connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x7}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x0, 0x6, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xf, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x101, 0xdd81, 0x60a0, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0xd, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x48000}, 0x8482) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, r4, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) executing program 7: connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000140)=0x8000) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x4000}], 0x1, 0x0, 0x0, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0xa0201, 0x0) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0xff51) executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='notify_on_release\x00', 0x2, 0x0) r2 = fanotify_init(0x8, 0x2) write(r2, &(0x7f00000006c0)="ff000000020000a2", 0x8) write$cgroup_int(r1, &(0x7f00000000c0)=0x202, 0x12) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2080, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_HYPERV_EVENTFD(r4, 0x4048aec9, &(0x7f0000000080)={0x3, 0xffffffffffffffff, 0x1}) executing program 8: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000001200010027bd7000ffdbdf25ac1414aa000000000000000000000000000004d5020032000c0015005907350009000000bdbc5e97b4c066632897a4352bb1a681b2a7444f2cf38cc135de1dd81e0f954d45cf2c8fb0738882f1cd77d2c120b7b7fd8bcd7c3c4691578ae3862db0c5a943baf92ac7cf9b460ca37737ee8d55f2456cf3fff40bf702b27507cbaf1e6517e8022d09e09016a10f4bddb8a1aef747574567afb8807f176fbfb98ab00ae945ce541829"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r1, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2081, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x7) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000002c0)={[0x2f, 0x9, 0x9, 0xffffffffffffffff, 0x2, 0x10000, 0x7029, 0x1, 0x8, 0x0, 0x6, 0x9, 0x4, 0xffffffff, 0xffffffffffffffff, 0x8], 0xd000, 0x40}) ioctl$KVM_GET_NESTED_STATE(r5, 0xc080aebe, &(0x7f000000a100)=@vmx={0x0, 0x0, 0x2080, {0xdddd0000, 0x0, {0x3}, 0x0, 0x1}}) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000000)) executing program 4: prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200000, 0x0) fchdir(r0) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x10005c9, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net\x00') openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x3a000, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000892e79106d042107259c0102030109022200010000000009040000000e010000082402010102000008"], 0x0) executing program 8: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x1938a00, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x301000, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000040)=0xdfe5) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x10000, 0x600000) ioctl$I2C_PEC(r0, 0x708, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000200), 0xfffffffd) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x806, 0x0, 0x4, 0x7}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r0], 0x20}}, 0x0) (async) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x4, @remote, 'hsr0\x00'}}, 0x1e) (async) sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937e, &(0x7f00000019c0)={{0x1, 0x1, 0x1018}, './file1\x00'}) executing program 9: openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x1) executing program 8: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1123102, 0x0) (async) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) (async, rerun: 32) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) (async) listns(0x0, 0x0, 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) executing program 9: r0 = syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) syz_pidfd_open(r0, 0x0) ptrace$setregset(0x4205, r0, 0x200, &(0x7f0000000140)={0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000180)={0x0, 0x0, 0x4, &(0x7f00000001c0)={0x1, "96e67ad2d329458afe83c914c4628900000016c0c2fa29d7004600"}}) executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="df0d0200000037b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000640)={0x40, 0xf, 0xf, "aa63c2a22a007afb3282cf2f77dfb1"}, 0x0, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @loopback}, 0x2, 0x2, 0x4}}, 0x26) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_load_code={0x12e, 0x59, {0x0, "0f01dff23e0fcec4a17dd7d566baa100b0cdeec42220f38b0100000066baa100ed3ef3410f0966b8f3008ec066baf80cb81809ed8eef66bafc0cec36262e450f30"}}, @set_irq_handler={0xc8, 0x20, {0x7c, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xdb, 0x2, 0x8}}, @out_dx={0x6a, 0x28, {0x265e, 0x4, 0x8}}, @wrmsr={0x65, 0x20, {0x8a5, 0x100}}, @nested_amd_clgi={0x17f, 0x10}], 0x139}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) bind$x25(r2, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r6, 0x1, 0xff}, 0xc) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) executing program 9: r0 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r0, 0x0, 0x0, 0x4080, &(0x7f0000001a00)={0x23, 0x1, 0x0, 0xa}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r1, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x3000, 0x0, 0x9) executing program 8: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r0, &(0x7f0000000100)='7', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x9, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e1c, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) executing program 9: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x1938a00, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100)=0x7, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x301000, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000040)=0xdfe5) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x10000, 0x600000) ioctl$I2C_PEC(r0, 0x708, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000200), 0xfffffffd) executing program 8: socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000010008104687da3aa7143a0b8c81d080300000000000000a118001500060014000040a8002b000e00014006046109d67f6f94007134cf6ee0a000a0e408e8d8ef52a9bbc7c0b7a196e6f66112c88a2ddddbbb219c6c09136dd481c4a918d1bcf0f938ba3495169ea70948047ec4a5d060a517898516277ce06bbace6f177ccbec4c2ee5a7cef4260027836b0d17a54ef5d6d9342484286f95728886fffcc44841a6db702f071f468430dfe1d9d322fe7c0acfa5fefec64193071e9f00feffff16ac9609f4fb00"/216, 0xd8}], 0x1}, 0x4004) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000280)={0x23, 0x7f, 0x3, 0x1b}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) close_range(r4, r0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230686f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8040880) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xbc}}, 0x0) executing program 9: r0 = socket(0x40000000015, 0x5, 0x0) sendto$packet(r0, 0x0, 0x0, 0x4040, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[], 0xfffffee2) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xf, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x7, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, 0x0, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1800, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r9, 0x3b83, &(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x6, 0x800003, 0xc53}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3) gettid() executing program 7: r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x1411, 0x200, 0x70bd27, 0x25dfdbfa, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0xfffffffffffffd11, 0x4b, 0x35}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast2}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x7fffff) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4a) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r6, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x80000) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, 0x0, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 16 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$inet_sctp-getsockopt$inet_sctp_SCTP_RECVRCVINFO-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_STAT_GET-setsockopt$MRT6_ADD_MIF-socket$netlink-connect$inet-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CHECK_EXTENSION_VM-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_GET_LIMITS-request_key detailed listing: executing program 0: r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x1411, 0x200, 0x70bd27, 0x25dfdbfa, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0xfffffffffffffd11, 0x4b, 0x35}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast2}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x7fffff) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4a) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r6, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x80000) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendto$packet-getsockname$packet-openat$ptmx-openat-write$binfmt_aout-mmap-madvise-write$uinput_user_dev-openat$kvm-sendmsg$nl_xfrm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-ioctl$IOMMU_IOAS_COPY$syz-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-openat$iommufd-ioctl$IOMMU_IOAS_COPY-madvise-gettid detailed listing: executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) sendto$packet(r0, 0x0, 0x0, 0x4040, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[], 0xfffffee2) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xf, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x7, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, 0x0, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1800, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r9, 0x3b83, &(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x6, 0x800003, 0xc53}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3) gettid() program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$kcm-socket$kcm-sendmsg$kcm-socket$phonet_pipe-connect$phonet_pipe-socket$can_raw-openat$hwrng-close_range-getsockopt$CAN_RAW_RECV_OWN_MSGS-sendmsg$inet detailed listing: executing program 0: socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000010008104687da3aa7143a0b8c81d080300000000000000a118001500060014000040a8002b000e00014006046109d67f6f94007134cf6ee0a000a0e408e8d8ef52a9bbc7c0b7a196e6f66112c88a2ddddbbb219c6c09136dd481c4a918d1bcf0f938ba3495169ea70948047ec4a5d060a517898516277ce06bbace6f177ccbec4c2ee5a7cef4260027836b0d17a54ef5d6d9342484286f95728886fffcc44841a6db702f071f468430dfe1d9d322fe7c0acfa5fefec64193071e9f00feffff16ac9609f4fb00"/216, 0xd8}], 0x1}, 0x4004) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000280)={0x23, 0x7f, 0x3, 0x1b}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) close_range(r4, r0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230686f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8040880) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-socket$nl_xfrm-syz_fuse_handle_req-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io-sendmsg$nl_xfrm-connect$pppl2tp-syz_kvm_add_vcpu$x86-syz_init_net_socket$x25-open_by_handle_at-bind$x25-openat$mice-syz_open_dev$evdev-socket$inet6_sctp-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST-setsockopt$inet_sctp6_SCTP_DELAYED_SACK-write$char_usb detailed listing: executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="df0d0200000037b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000640)={0x40, 0xf, 0xf, "aa63c2a22a007afb3282cf2f77dfb1"}, 0x0, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @loopback}, 0x2, 0x2, 0x4}}, 0x26) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_load_code={0x12e, 0x59, {0x0, "0f01dff23e0fcec4a17dd7d566baa100b0cdeec42220f38b0100000066baa100ed3ef3410f0966b8f3008ec066baf80cb81809ed8eef66bafc0cec36262e450f30"}}, @set_irq_handler={0xc8, 0x20, {0x7c, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xdb, 0x2, 0x8}}, @out_dx={0x6a, 0x28, {0x265e, 0x4, 0x8}}, @wrmsr={0x65, 0x20, {0x8a5, 0x100}}, @nested_amd_clgi={0x17f, 0x10}], 0x139}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) bind$x25(r2, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r6, 0x1, 0xff}, 0xc) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-timer_settime-socket$inet_tcp-bind$inet-recvmmsg-openat$snapshot detailed listing: executing program 0: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-timer_settime-socket$inet_tcp-bind$inet-recvmmsg-openat$snapshot detailed listing: executing program 0: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-syz_emit_vhci-ioctl$XFS_IOC_FD_TO_HANDLE-openat$cgroup_ro-statx-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_MD5SIG-quotactl_fd$Q_SETQUOTA detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-syz_emit_vhci-ioctl$XFS_IOC_FD_TO_HANDLE-openat$cgroup_ro-statx-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_MD5SIG-quotactl_fd$Q_SETQUOTA detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$802154_dgram-mkdirat-openat$ptmx-mkdir-rt_sigprocmask-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$netlink-writev-gettid-syz_open_dev$usbfs-capset-mount$overlay detailed listing: executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$802154_dgram-mkdirat-openat$ptmx-mkdir-rt_sigprocmask-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$netlink-writev-gettid-syz_open_dev$usbfs-capset-mount$overlay detailed listing: executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) program did not crash single: failed to extract reproducer bisect: bisecting 66 programs with base timeout 1m40s testing program (duration=1m56s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 16, 28, 15, 6, 13, 13, 6, 14, 4, 14, 30, 2, 2, 2, 11, 2, 10, 3, 10, 10, 8, 16, 23, 30, 30, 3, 3, 7, 9, 3, 7, 3, 6, 6, 7, 7, 7, 5, 3, 5, 5, 3, 8, 16, 21, 22, 7, 21, 5, 9, 16, 8, 18, 11, 6, 9, 7, 22, 5, 6, 18, 11, 2, 30, 14] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000900)={'vxcan0\x00', 0x0}) r3 = socket$can_raw(0x1d, 0x3, 0x1) sendmsg$can_raw(r3, &(0x7f00000004c0)={&(0x7f0000000140)={0x1d, r2}, 0x10, &(0x7f0000000940)={&(0x7f0000000000)=@can={{0x0, 0x0, 0x0, 0x1}, 0x1, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x10}, 0x1, 0x0, 0x0, 0x84844}, 0x14) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={r2, @local, @private=0xa010102}, 0xc) r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000040)={0x1, 0x2, @start={0x5, 0x1}}) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x78, r1, 0x1, 0x70bd24, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x41}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8b3c}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffa00}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}]}, 0x78}}, 0x48040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)={0x2, 0x0, @b}, 0x48, 0xfffffffffffffffb) keyctl$revoke(0x3, r3) (async) keyctl$revoke(0x3, r3) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x34, 0x0, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8100}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @tcp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x4) (async) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x34, 0x0, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8100}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @tcp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x4) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r4, {0xee01, 0xee01}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r4, {0xee01, 0xee01}}, './file0\x00'}) io_submit(0x0, 0x1, &(0x7f0000000380)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x2, 0x6, 0xffffffffffffffff, &(0x7f0000000280)="3d0964aea57c4325f40d420a946a424533e9f0c0f7ac4020c6e786ec0d88aaa7411c6b3e4ceac3117bc3339211eced8826047dc8474046a4e6656f921309a503366d9c83dc7774955d8d384ba992fe2e65211ea8b504c7b877eea4807ce55c98d8768c3cb8ae487bc256", 0x6a, 0xa3, 0x0, 0x0, r5}]) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r4, 0xc018620c, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x184004, &(0x7f0000000180)={[{@inode64}, {@grpquota_block_hardlimit={'grpquota_block_hardlimit', 0x3d, [0x34, 0x78]}}], [{@pcr={'pcr', 0x3d, 0x10}}, {@hash}, {@audit}]}) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) (async, rerun: 32) socket$netlink(0x10, 0x3, 0x2) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async, rerun: 64) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff, 0x10000}) (async, rerun: 64) close(0xffffffffffffffff) (async, rerun: 32) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000680)={r4, 0x1ff, 0x0, 0x1, 0x3, [], [0x7fdfffff, 0x0, 0x0, 0x4], [0x0, 0x1001000, 0x1], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) (async, rerun: 32) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000890000/0x4000)=nil, 0x4000}}) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r8 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000086a82, 0x0) (async, rerun: 64) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000000)=0x1008200, 0x4) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_DEV_SETUP(r10, 0x405c5503, 0x0) fadvise64(r9, 0x3, 0x1, 0x4) (async, rerun: 32) sendto$packet(r8, 0x0, 0x0, 0x50040, &(0x7f0000000540)={0x11, 0xc, r7, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x14) (rerun: 32) executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) ioctl$USBDEVFS_BULK(r0, 0x5523, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) (async, rerun: 64) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (rerun: 64) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000280)={[{@uuid_null}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}], [{@smackfsfloor={'smackfsfloor', 0x3d, ']*-$'}}, {@dont_hash}, {@appraise}, {@measure}, {@appraise}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@subj_type={'subj_type', 0x3d, ',[,&)*-\x05'}}]}) r1 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x10000000}, 0xc) (async) bind$netlink(r1, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbfb, 0x808b9027}, 0xc) chdir(&(0x7f00000001c0)='./bus\x00') (async) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) executing program 0: modify_ldt$write2(0x11, &(0x7f0000000200)={0x77b, 0x0, 0x0, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000002140)=""/4098, 0xfffffffffffffe8e) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f0000000040)) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400800000a0a0102"], 0x840}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) executing program 0: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) executing program 32: sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x48081) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xb9) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40440, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1a) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}]}, &(0x7f0000000180)=0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) gettid() syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)) executing program 1: kexec_load(0x2, 0x0, &(0x7f0000001180), 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001f00)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000007540), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000007640)={0x0, 0x0, &(0x7f0000007600)={&(0x7f0000000000)={0x24, r3, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}]}, 0x24}, 0x1, 0x0, 0x0, 0x44040}, 0x0) executing program 1: r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='stack\x00') (async) r2 = syz_io_uring_setup(0x2af8, &(0x7f0000000380)={0x0, 0xc562, 0x13090, 0x0, 0x71}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r3, &(0x7f0000002240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002200)={&(0x7f0000000180)={0x3c, 0x2, 0x8, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x200}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4810) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xc8}}, 0x4000040) (async, rerun: 32) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) (rerun: 32) socket$kcm(0x2, 0xa, 0x2) write$tun(r4, &(0x7f00000000c0)=ANY=[], 0xffe) (async, rerun: 32) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') (rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async, rerun: 32) read$FUSE(r5, &(0x7f00000001c0)={0x2020}, 0x2020) (rerun: 32) poll(&(0x7f0000000f00)=[{r2}], 0x1, 0xc) getdents(r1, &(0x7f0000000040)=""/56, 0x38) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x34, 0x41, 0x107, 0x70bd2c, 0x25dfdbfa, {0x3, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0x1c, 0x1, 0x0, 0x1, [@nested={0x18, 0x10, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@loopback}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYRES64=r1], 0xd0}, 0x1, 0x0, 0x0, 0x24044890}, 0x0) executing program 1: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000004c0)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x6, 0xfdcd, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x24, 0x63, 0x0, 0x40, 0x11, 0x0, @private=0xa010104, @broadcast}, {0x4e26, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x81, 0x0, @val=0x80}}}}}, 0x32) executing program 1: r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x6c, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x58, 0xe, 0x0, 0x1, [@nested={0x54, 0x52, 0x0, 0x1, [@generic="6f784e8df96ddb651128a7a38ffcf1dd0308c33fa12db8a947f424a892a831217f9a97a3764574383b7ef8d45cf916d331c46b86459433ae9ec3f9ca195b5ed7a145aead9f1e384cf57ef81d5b7862a0"]}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) landlock_restrict_self(r0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x9b4, 0x0, 0x0, 0x1000, 0xffffffff, r6, 0x0, 0x3}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x0, 0x5008, 0x4000001, 0x257, 0x0, r9}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x2, 0x0, 0x146, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x1, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9efe, 0x8000, 0x1, 0xfffffffd}}], 0x1, &(0x7f00000003c0)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) r10 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r10, 0xf) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r11, 0x84, 0x81, &(0x7f0000001040)="0000000000000002", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r11, 0x84, 0x15, &(0x7f0000000000)={0x1}, 0x1) r12 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r12, 0x4058534c, &(0x7f0000000000)={0x80, 0x10000009, 0xc8, 0xe05, 0x20000, 0x28e7}) landlock_restrict_self(r0, 0xb) landlock_restrict_self(r10, 0x0) r13 = socket$inet(0x2, 0x4000000000000001, 0x0) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r14, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000050000000900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a308000000008000a4000000003280004800800024000000012080001400000000014000300776c616e30000000000000000000000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x20044841}, 0x802) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x50, &(0x7f0000000000)={0x0, 0x0}, 0x10) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) r15 = syz_open_dev$sg(&(0x7f00000000c0), 0x3, 0x200) ioctl$SCSI_IOCTL_START_UNIT(r15, 0x5) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r16 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x2, 0x54000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r16, 0x301, 0x1001f) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 33: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30220000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a3000f000002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: r0 = socket$key(0xf, 0x3, 0x2) userfaultfd(0xc00) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="020320001200000000000000000000000400030000000000000000000000000000000000000000010000000000000000030006000000000002004e206401010400000000000000000400040000000015feffff06ffffffff000000000000000000000000000000000200010000000000000063fd000000a0030005002b00000002"], 0x90}}, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) syz_clone(0x40808000, &(0x7f0000000080)="a9a8d82c521e2c8a8c235efccc8aa8e1b8d6392314a5b5fed82c56213d3257008f16efd66610", 0x26, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="cb3a1d23f722099b308f963127a82ac4b7dc3280ec7fd6740fc99c17ff6d4f2c064ff574f6fb4fa8afb21d3ab249b273ab8451c289474dff97de73eedc36908fc35f672ef44bc199c803285ea596f12c62b9579b8980a694f2def991997f13052dd21249ca7a8df77dfc1d263def92d9eb449980c3ce5e626fd209222da04fc7d5dadf0b073b37e2469e876833d5b7d28ffe29909cd30f65b18fe2dd0adfb687fc7294c2620f8318d45c06ff184f66ba3c0994658f929ba862a92999bf2862508b8a480d4f03445f4fc8f32261214d") ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000040)) r2 = fsopen(&(0x7f0000002200)='ramfs\x00', 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) writev(r3, &(0x7f0000001900)=[{&(0x7f00000002c0)="984f9c3d953f60a56b79d48c3bd707fc74d54715a184722ea64372bb3ec2bbdecadd086a14b2c7357680599448ceb30b19c5f620f0e2d05cc1966592a1834241d127ef979c8ea59095a40bf2a3d10f3196a918694761a1186507fc47a927e8826dc1c7f47e2885e4cb4d0a6f9dc7ec35ee11dabc214e68964e530088304ebedede5483d0cd9bdc59cb5dee9549ee4d97be5bd725993f51108da28a96a7fe4339fc799d2b10a8cfc2ab0794f7c2c0882d6e2d1a5dbc546a2f6274b70a1338aad44719b358a927f3ec3eb48a1c247bc9c1e770", 0xd2}, {&(0x7f00000003c0)="c2af8cb4a4276a13134ab0d200e2ba655c09b119f6c01d1ef62e77e352e7489f3f717e75e3011f5e9575598d8cc8552342421b236d40a7fc87407e77822526cac1344f9cb4b20272f066e4250ec77716c4efae53424c30ea385b1903ee60b140b239d65cd825f8d24db3b3706d8dfafb40a6d1f0d5c94fb31a0d6ba3ba3584f9a933223b2eb06727dbea77addc5f452f7ca3a861f709537d9fa5522252ae45db7e6eaece05c9293ac27c5b16aa2aa22281f77ff40ec14809d9549386e9b750d1b96d542d8ab101d17cbfa075e8a01c02274d92d14fd0", 0xd6}, {&(0x7f00000004c0)="5ae080571365ab77efdfc6a969b5308d2c7c63f7af241d580e2ada3ed65cf8c5d74e67e503b54eb95c3cf30027359035a04d710944d29d47c4c51e6cc044e7a63dc646b9ddb53d5c9f23d94bd44a873fc02852f5c1fe2ca81737cc0fb4868585fd872a18bb1fd7e28ee7dd07df6cd996c9232906b5e380290f58fd8841a98af055c23e93723e50e67171ebf23578b36e6668ed7235ed0fcc8225bc8d6d530b399526ffa4d91dc9b9f8afe078623a9938eda5ba3f", 0xb4}, {&(0x7f0000000640)="5a4e9e9b10bbec3e2ed75f4cf5f101caa1ab4aebd3b34816387d702f2abcc2f7a3b4e42f279911f8edcd95210cca1b84f3ddb8155aa162cc4c1a25ba768054df764a02f9387d54d3e0ad554a8d52e77ea340b399cd967a80b836c8a2484b918e315cba2dd118077c1cc31a8e3db4d07385ef5d7ddac607abb7a3b5a2ebb5d1502b13279ae1967124decc5fa8492ede12ee575267a80368432bdf393fe3e4ed5d0c1f4b2a6e42960a106c2e566c537d5397d779ac8319c7bf305a45a0de716546cacecd9c682304e8a358b194f1a48ca630b5c4fd24f355bcd5a128c2214dd79b59988a67ab10536ee1e649bad5bad42c804af709bdadcbe8819323b2c7fafc5f0cd41c1d211f5ec1d9b66528df66c38cf8a9ea534e132ddca512fc6d136c08c5b950fe8c38049e817152815e90dcfd74307a10bc54206c5faba13d03ae06c65c2bc4ce8ddea9557dd9b7bee0effa7afd12988631a9a0a42fbe575b31a9d38163214ca1aba3211419260a581a508d2610fce02abff6fb53c9f878d9c5b8dfd6526a05e46b3e23cfe1ff4a2a9f5a3b868abe8040b24be367ede37f4147486531055f8128a23802d21c9d0c6091524990654dece6f494237324378ccf26059071d662c1b2b882e0128d967fc22aa493bf1ea307c2cec39db43989f0c9bad8c442d36af5d430bd69dbfbfa9be7e29fd68a343a7c71d53cf697922e0a383f7cd4e77d44b81607bd443251e608be3c6ee6d1dfeef4b223fd8ef9f48bfce06cdec3e7ec9b50a77394f79d1e3167508fdf52bdef362b3cf1c1b0b70ce7d940f3937debc9f656369e2aa82ba6f5d2a0e2dccbd07f54daa546f018428d6a7f72fdd9babed44bb03496ec95ded3061da45123aa9d230e6b37755eec374d96963a83d71384cac4e00f525908f341978e99e58fd464c930231a3e0da0ef1cfb2404a020ae1afcd5c17a7930a0b7489b39c9cf9a2fe3d446121bf638b2828b5365aea8dce4d7c1c10719b70d9ba090e7521b0ddad604f6c5bf3e8c7e8a8bca304b22addf75e4eb32cba2a46435c19206e89813e9b6d6312bbd5d7c3325ac06da33dbcbc78d34975385a6df18d200a8ff5d61a492f9287e55be649a21850363ac2ba99dadd32d9cadbc901a4602779c4c3c90d1106a6917a25f4ecb67e9b472c05a2a71ddb7ed1687c193e701141f99f2309415ae68aa6c14ee5ff44bf691ad3a198567dcd92bdd5371f8c7664eda1c44d0a752639c46b67e360482a91a7284e5038bb8be2b7057730cf87079fd6da89f17f4cb5fd588b544d59c6372c6679fe3d49147ec56308f8efeb0f9e8621dc9d3ba05f49b9aab2d955bf22319d5cf75a0f76a73a21b930521e7bdbf174dcca896ab80ff3503f5d3a2ebc70fb261659908c017d3edb0286efca92b7db04e6b8a145aea7ce96600a26c737eed88cc23a5124830e1781abc36b2545f967f06424a133bc42d1457f28183397a3a038bf73834cf84663503cf8a3f0776e77a331299e26e564d306df2d0a3708a54b8fb3b008d16f76996523ed40c76900c3542e4ae0ea73cc94867eb2892f996cfdd99a74ea42a6f10ea95e5ef242bf51d387e4777b5f955f44eadb819d10594f5555f436518243c85154b89e10725aa987a4639a3ec36936b0b7b1aa782affeb92031095482e00b87484b9e7f0b7a74c70c9e6c5d7284b76e13bdd5856a3445a1122bf0884846b7dfae5a6ff7ddc9f1dfb9f8a8d69244488e1e3f3ea270595d1cab4f9a623fd12f5813bacdb9b4b13d2117a6a2fc27a2a6a7a8517a589116e8391d9f6a67af19fb0a2a0362d563e6ecae8d3f14bfdedb17ca115cef0249ce4b9849029295b0c2e3a112ec19b3899cf187d6a31cdf8a4fdc5e3c39fa954a7e94f57106fe43e5051b35c31458249c4514ef8a798e42e92529e1206c83699269f3c431e149bfe2e97303577cff3fae39d8afa2de41a6ac05cf020a12143bad89c516a23ce2f4a35e9602c87c4966d56220dbf7cdfc90a2a9f64cef7f622c4055f111822eb9f9fe16a77022f891a1681697ffce40cbfc8516f6b9f0f3b7b26d6b6ebfbd9d4ba676f7ec93483e9b29f662fbabefec473459ef981b7cf410ed2de24b9afa2b7c8dda1dfc06b98e97b2af68c9d61918f73a7a339c8e2d9b6f118f5115afe77f4586d1b9e993fdd8e008574210d19b3b693e21b50e97a5d631f730560a06835db4b4b6494ebae5a46210ea078d63e515ab284130c218a407c0bb9f51aca4e83c3d24a0a123ca0f65a8f63f75fb4444dc90129ed081049bc3b7c4971a339cbbae1fa08a1907a2fbdda336bef10073cb742b5cfaa717885b4afe82792874dc3b9a177675306c0505da9c54422470404ab5d6c562f9acc66fbb4dedd760b7d8d633cd89a79a138c9f2e536ea3d161265366dcc7a13ae0f0d80e21249bffe57599758f7027f526e04fd6e2dcde6288a73e0514009fcbec3a4100586d2f8a58510a335260599574ae6606d61813d87ac5e133cf69c36e890781d4361962ad22e908236d791a85bbe5dacc1a7b8c0318214e53dcb70a8827fd51d25d4b3c9ce322fd8cc4b184d994bcf115cd0fc12136c3fe2c3447f8ffd76cfa2446d369472438b27f77eaf97089d5d272c0746ddc72c34a8b3865c64748cb1b8abd390d28ae19e4ae43402c9adbac08fe991baa84c8c1dbcf6dfd7ba2e318ffebe0ec04098a49755d09db1fdd48297475fd881e6ab04a805779a1c6518fa83e006fe6d2d719e14648f8bbca7e2f70dbc8e0e933eb4f41526476b6afd17b34f92397e6d8979593089d26beb1143d376dd74dcf5d73af8754db1b3b75f7f731f263119065a3792be320f9b85f35cdb5b78b672ecf4f65501e07c3f50a4fe2642dc932166e05e9fcf49a2dcd7f6bdfab0013769e30faacf02ad320f290103eabd8927f87e7fbc3d5be99fa52aff61c6f3becfc53ad3848d30f45c01da01df410b10203fbf10dbc30ef7bb90e65f50591fb91d6f53b321e3e50aab9f11e96ffb670428450c6828c5a438f110a1eb0db46a4fc93147c1dfa4a544ded64f53a31818339f6c972b58a4c1f90832446ca5cc9bd61fbcaf4916c705e20864a0ce1f6ed3035319dd9ca0e9987bd7c1943ea1c9f0de6f6af5ccd1b5dbed75b978c4c82cb34938c780367880aef710401d0b67477119c5a55d7d80a600734f92165c89c99816b5ac7f7d250ea216b51906be2fcfd0b8fb753b4d5e4c3e1b9e55bb20cfc3d7004793e8e87273b84eb906b8f1edb82928137d6e8d02c3d63d061cf085f5bb7ba2137119e156f4666b94348e8b7f08e81bb6e5dea70a201dad39a9a1e9b315d70945a2bde0689530762a519b215cb5b16871a16d36bd29d64bfe47d7ceefd876531ab39a25e1c2661bd24d476d97bd9828bbe1053dea3daae1f461c9246ad2c190247cfb16040f7d619ff723d89f722965048b7eba878897853d77c231e3756ed0434651118c91fefd50a7fba96b6c95ff1aa9e794c8e5824bf2243608cb63829cb2004d70ae7000c0117873167f88bcacdae37fccc2864da5d6f80a3b4cf7362f1895e5f62217fbd111018feaef2110e7ff47831a71cd0429b0c18e2fb8a3afd7a768a2aceb72b0cda75afd9e17cd70550eeac2adec87aa0faa23f3c0b52d5a52a67106d7d6434da8a8f13e34696c88f08f095854d9dc42181f4b93fdfe8e3f1934bd300649b8622d38bf9cfeb50e8e9d7c2297a4456a75acb57b069957af924499e891cbc68c737918d64e95b9afe9adcd0db334f4f46f982b0b4e4b585546b0113a50b16b46274a872f512afb5e9191556f508f934503d97369f8f3299a824994c39c4a7d8680532623c7228af32e8c4f970982f561ac9a9c72916b94c270be341702005a7d2e836c940f33bd25a35bce09c21d1543b4ef9660cc262e87cc5c09721ec871948f55d81b64a007d8cd55ebc7df0ccd27fa0435b1cfaf59b22473f1cce434041a48dbeb44f02fe9a9821f42ad258462b7502677101fc5cadb06b92c8f214b3e8b8eba4fb72f6b0826472ff803fe978de6c68d3abf5db80df1834e9cfe867d538bf2f7312609b3bddf373a9e600a9e5277d40072f3d06cc29c1ed621651b1a27fda93ea36e7ce45170d7b5c1f865948facc97996095c344135420d2ed6ef0a396b5003dca986bd543070fd95efe15ae188e350e429091440c267d734134fb914c3bb3e2b1e9b55b8eb0303eaf1fa597443d28eab0de2a70b0156493fd9ccfb555b8d8ed7e3e029193cfb2caf3944ec4e055f12f525c87a168eb5c7c8c91fd62c92b554d6ca496ba847ecc0d7882c96510919bccdaa4d482576b900ac4cd95baebc255abc316b3b0befa14f1de961ad2996663b00215dbb836c36442f801dd3f4738771aefa269f4e8777e1acac5be3c17c2155a259f26c523e456fb5edfa20bf89c7d78ecaaa3cd92ee972862009084a67a5a3c8bf55c2676db6eea3411ce60103357b5b7091f82a42e12db0e402f791c20d5352a72f2211abc37e36d8d04bd7dd45627ac44db5a0da35d116873bb8e67b737f5f7097854b9359a5bad5f62b1353a62c008127ce22df5fe409dbc785239a6060a931a7f3055b2f9cec8ccdc0e5e7cceb54e993ac46f4af1346e30ec1efc4f3a89a262f488e5fed1c56fffab032754fe6425650b3c8b8201b272948b31b306c28cedfbd73063a81718473c2aa2ce16c4fd084dcd83b43f2f8a7b5cfdecd4b56b1cd4dad0ffd7cade5661ff9cc2a4819c2df0f651ae126b7f44df1ad3327b9631de27b1045270ad38153bb64cd7850c2097116fa0a452f94212794eab748b98e0d995e69f3ff0d92db4f6a640d12833390f8c8df3f6bf97cf98bd8c58f9d5139bc8b7b365cc330fc0dbcd22f3173208c5d1a8202275868cbcb8235605e22ae6a7021c88c5ba72418d2cf9cf48f34d962b4a56924455472ddf815b57458a2e754291fe0edea5a31a5814914e5ef82dcc913cf2625f963dd00f19552115d6dbf6152f4a11de4e198f1ddfa35fd382d4fc8d04210e38388ff5d830c484aec3915c6240f5b6a9186308f642e76e26d76d66e97476a35765e093e7c738edd46fdff60074dc33be7d9919d22d274a1253a4ada2e95bd76b63cf8a94d1ebb0c37c1796b0ef8a7797ba996fe80cd6dc7d9d5ed0e39e83bd6b89d13dbbb098041c5d6920d9fb3ce5f1f70fe30406e00f099736e044a4ef48975e3a05cb0b4a1178da378ce33b2568462ab923d9c89a9bcba0324d2e8a6b21a84e44b1298aa08c5f0bda4863ea70cfe64659dd871b97c562fd7fa75f94acc05658a80a6af02d8a54ee6ea8d3b63fb2b9bb31b61713922ab755be852bf99a1d9183d4b6f66755c0c87b180202bbaee584795375b47ca65adf92aa311dc274266bebf276a085525eed3a3a0cf2840e9a62f26d2a5085902636e3fdf41d6b537199d70e624894fe5fc05f7e73717d8ef5d3ac18da62af9415fc32ebaeab4e0d17f82dc88a4e415e13690ea3de36454c4f5f5161a05004d196b3ebd115fad55596b4233c9b225ba0610e30a4215cd1995aedcf32e85603edc2a7ea732d1ee2490969a6373f6d7f63defbdd4ca2fd187ebf486e29185b2c0be6d31c5bd4bad431771659963967b8e26ecd4736632b553c707319fb7dc66441ed64e418fadf745a117439409cf001694339ed965f80f57b4bff4631d6be61966e5c7c22a7b85f4433a87853004ed49feb248d69594ee3ad00eac4929491c48a49d7fb84ddd3aadcd15a0a050f2dd8d3ac3d09795233394a3ae1de2d7fa39a559b523bd16556481753f0a91f4dabacddd5", 0x1000}, {&(0x7f0000001640)="3f861b7932173df16677dae35d58ed2b0fb063dfee8b117d28f4b7d1a9ebd72801def660eb6511bce56af1a031963e0b30e358538587ef463ad01489805a45473456ef8cffaf182b33dd09c9c6397b968e95d374f1c0ce621a", 0x59}, {&(0x7f00000016c0)="c13286e174a1fa16078702c00a6c95ca75319f8bef8c59f0e92317f9beea46ddce63ebb20cc4444cc931b0c87f453e955f0c2b171902ae13a8f94457b72d5f695e4acd05f2f61c5a4c09831c44a3d01073db70ceda03703d12aa394cfce208730e48930906e3dec78a5e629b2dc8e96f6b8b56db98e3ba04564e2e76bc1f3250e955b243e7c8447ac217b4e88d2ac59d35aabcb1d8e7e0f9a0928ae8976fd024a98ac0e4a41c96fad10e215f36613ed6952b6eea843921380bb5ebf3e8cdcc9aacd870f02dcb5f496468de8631a49b12b13c960946c3521cccd757885d6bbc508e6cd04afdb5f2f2b577f51997c0603a", 0xf0}, {&(0x7f00000017c0)="3a649faa6126d6bd7a74c7db688a26b8ee080b24c8489dd9a9c5c945a4edf41e358cc2af110e34508d0e4bcaa93383d47ec134d9a84f3b84b749c2bbdc91b93401ade21ada01ec6e4beadbe6a0a390b04d74eb9b090177", 0x57}, {&(0x7f0000001840)="ba1a221048befa23d43f25c3f340c28ac307ae0b502712ccf381308681d352a729edef462aa368c3db1555dee4f59c03e5ab573db2c1ba06ee202a776f4aab3c21601fb4ce6dac235c2255eefb5751d88e9409d722401b32cd622bf9e7c460a6f9063e8025ad679d0460c9a3496122ae0b0129fa2395c83967e72122cf488084ac581671a75d4ec3d8a730a46e6deeb40a78474fbab5e93d7f0e8dfeaa04d72bf8c058a2ca3e36a045cd45e35e", 0xad}], 0x8) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a3000f500002c000000030a010800000000000000000100fffe0900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c000480380001800e000100696d6d656469617465000000240002800800014000000000180002801400028008000180fffffffd08000340000000000900010073797a30"], 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x107) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getflags(r2, 0xb) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000400000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060002004e210000080007400000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e21007d250c49004e24000008000200e000000234000315b0c313004e230000060002004e2400000600013a4e200000060002004e200000060002004e230000060001004e200000140004000000000000000000000000000000000008000200ac1414aa140005000000000000000000000000000000ff"], 0x1e8}, 0x1, 0x0, 0x0, 0x4004880}, 0x4004000) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2cb43, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x8000000000000001, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000440)={r0, 0x0, {0x0, 0x0, 0x0, 0xe08, 0xfff, 0x0, 0x0, 0x2, 0x1c, "339f020bbe78b39843d601010000000000080d0ec0c1b4e9b1c40600220000000000c594b1b3d741dd17c18e9438ef2a565ef1e83323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e01008e164f000000000000007f02000000000800"}}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) executing program 34: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e06f70d08"], 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f00000000c0)='usrquota', 0x400000, &(0x7f0000000100)={@_ha_fsid={[0x5, 0xff]}, {0x2, 0xf2, 0xeda9, 0x2e298cd0}}, 0x40, &(0x7f0000000140)={@_ha_fsid}, &(0x7f00000001c0)}) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) statx(r1, &(0x7f0000000280)='./file1\x00', 0x4000, 0x4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x0, 0x31, 0x0, "dbb7c5e4b5f5fa1cbb4e1f16c4dcd2ed8e1ebf332c2d01864511c288176aabe3c3bc1b902e954cdb82763b3128312bc60a58dd0832f0d6d7f94c15f85e1aab450bf2a54f6a11a79c22929fc29fe9ca20"}, 0xd8) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r2, 0x0) executing program 5: syz_open_dev$evdev(0x0, 0x20000000000, 0x840) r0 = socket(0x10, 0x803, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000001000/0x4000)=nil) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000080)=""/108, 0x6c}, {&(0x7f0000000540)=""/35, 0x23}], 0x2, 0xa3, 0xd) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)={0x20, 0x0, 0x1, 0x70bd2a, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x6e}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f00000006c0)=""/118, 0x76}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000001fc0)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) syz_io_uring_setup(0x228, 0x0, 0x0, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) close(0xffffffffffffffff) executing program 5: landlock_create_ruleset(&(0x7f00000002c0)={0x1}, 0x30, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000005200010003000000000000000a0000000c00", @ANYRES32=r0], 0x20}}, 0x0) capset(&(0x7f0000000480)={0x20071026}, &(0x7f00000004c0)={0x0, 0x3, 0xfffffffb, 0x800, 0x4, 0x8}) fsopen(0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000480)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000009c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x100007, 0x1, 0xf06, 0x3, 0xb4, 0x80, 0x9}, 0x9c) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000140)={0x40, 0x40, 0x9, 0xff, 0x1, 0xe6, 0x8, 0x80, 0x1, 0x0, 0x81, 0x7f, 0xf8, 0x20}, 0xe) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000001c0)={0x3, 0x3, {}, {0xee01}, 0x8}) quotactl_fd$Q_GETNEXTQUOTA(r4, 0xffffffff80000900, r5, &(0x7f0000000200)) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)=0xf, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x6, 0x1, 0x1, 0x4001}]}, 0x10) splice(r3, 0x0, r1, 0x0, 0x20000000000002, 0x2) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) writev(r6, &(0x7f0000000480), 0x100000000000003e) ioctl$PIO_UNIMAPCLR(r6, 0x4b68, 0x0) executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffd, 0x6, 0xb, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000200)="800400001900", 0x0, 0x0, 0x10010, 0xfffbffff, 0x0}) write$tun(r2, &(0x7f0000000400)=ANY=[], 0xa2) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000016c0)=""/4071, 0xfe7}, {&(0x7f0000000140)=""/32, 0x20}, {&(0x7f00000002c0)=""/145, 0x91}, {&(0x7f00000015c0)=""/191, 0xbf}, {&(0x7f0000000180)=""/26, 0x1a}], 0x5}, 0x7fff}], 0x1, 0x12, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x80400, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r8, 0xc02064b9, &(0x7f0000000180)={&(0x7f0000000400), &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2e, r9}) r10 = ioctl$KVM_CREATE_GUEST_MEMFD(r7, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r6, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0x2000, &(0x7f0000bdb000/0x2000)=nil, 0x0, r10}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd0196db0af38f2665cbbb4e66534143d02eac997657cf0a3df3cc8df5281ca813b255039632532f021a46b78fb7892513e4d3307f2dc6eca9986be03dfdd7dea5a59b3af0f59c39d0edaaf273933db78b8653e664f28ca6a3f8803662958348e8bef4a1370e5fc0c803eeb3e1", 0xb7}, {&(0x7f0000000700)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16", 0x6a}], 0x2}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129d", 0x60}, {&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af84202254eadfd12b56f2ebc32396500466e9f16d358dd5354ef69bb8caedf66a220372311a092a4f03a336f27222302c6364b738a58c3b8e99d1a40552dfad46ba272544c0b39ebbca7d1da95fc74f6010956a8bb3165ee8db3867d1f92176de044693fa090b97bcadedd59b7e509e0d60017b6a3b025aac6650826d7f3406d4206b4d714c620225b5797e60513988e244874ac2a0ac80d18c707edf4999d1beaf841f2b8dd9a3da66e193ef2ab6ddba5185b5fd322187b4ff2f9677ecd725eaf86412158b744e32abb8ee3c039cce34f129d6f2665630931a5e03fc6984278e20e320318b0aa676822c2f732337cc75a858a07ed8c17b323d52ee421e79cff1800d1da3f311699f5eb8792f6d67c035ea9348f7f6ff81b9143db4742618e5ffbe48865d787e0a31f8e4d9e7895eb15c36ba4a81355080818efd3cd792293ec3e8cdc577f5c42abbb74331b352f17772ea7cdab8bb640b11db772baa4b32069b99e4cc43118257afa84eff7c8eb2c585da8e8e76404312b55db433c7365a866bc2a678f4817ba7b0838d63eaca429ce563fe8adfe7f114a941f629017d6f0ae80d2c0952ff5550bf361bda46eca47e1c271e0241d60290b9f8e1261b447ad0ba09fab7881291f7c2792537e7a5948eaba0235472406903f1d7095800da3aeb07e914868f2e75208b7354bd8118e91f1a8324c2dac24d633bedadd5b1fa6f2a2df302b7c7516f7f87fe570807fb205b287da3f3a1d4f66cade6cf61922cfa0f23212e282e260655a1d7dffd3be5e2c87ed16b6132de36d46240b76e0ae38e9ba2ba8655672a994adb8f3c4f898716f28fb2ad1272dd8e023463620b33f26ba1fc920cd0c4988d906204c63b4e419b376d858a5102d1e6b7a6a64407c96a841de8884dc0a87f6b93155893a6a6e96786eacf7ade1d81bc0a41812792b6ca7788570c88434a9386acde275f9f89c9cccf1a7e78b7bd695e3d2bf79dedd36862838263ba190b4c6dbe3ea6ce7ca56be38830bc8565f38a6c3d5d12fb92b61cab69af17ee94a0d5438eb96a566aaa3a621d2f8f34d7273cae47adfcf233061beaa7ce9fa34f4fb46528ca1c819d0068d82a7bb3a900eae9d8237eb694cef5df200b548c8fb87f1523281865d40c652efa2f014df7218e85579970ffdadb67bf0c71e961f19ced3c84ac568e6f2b9241b00444fa5b052d28a6cb872e7d7e6d025707729dcf510683462e61eddd91799ab3a18b8fdb04c6", 0x3e2}], 0x2}}], 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@private0, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f00000006c0)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f00000008c0)={0xfffffffd, 0x80000001, {0xffffffffffffffff}, {0xee01}, 0xffffffffffffffff, 0x4}) fstat(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000640)='./file0\x00', &(0x7f0000000680), 0x21004, &(0x7f0000000a40)={'trans=unix,', {[{@directio}, {@cachetag={'cachetag', 0x3d, '[,-:%.&'}}, {@cache_none}], [{@fowner_gt={'fowner>', r11}}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@dont_hash}, {@flag='ro'}, {@fsname={'fsname', 0x3d, '-!\''}}, {@fowner_gt={'fowner>', r12}}, {@fowner_eq={'fowner', 0x3d, r13}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@obj_role={'obj_role', 0x3d, '}'}}, {@obj_role={'obj_role', 0x3d, '/dev/sg#\x00'}}]}}) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="5800000002060303000000000000000000000000050001000700000013000300686173683a6e65742c696661dc8300000c0007804e4d9d3e000000000905000500020000000500040000000000cf4def687afca92e3f224e416b980fe4020babe36d93b4cb40b181ff5c5157224ba926f5862fd8f4ae37b9c8dae407dc0d34dc55b464e4d4bef9096dfe8cd2073a67be1f17fc320aa3037aae81a1a3185d9aa7b99d2c74c0e10615b2c40d7d088461182fc1ccdda55c00b524d23af1c8080309923ca4d71f31b78da03d61ded4017e5c5e2c56457817850062410715184535f4c583c94bdaf9840e48fae97ac3efeedc7b176d86de36e90e645777b456229a71bc9cb8f685e39decc90fe8d563dde1e6c6bc529dab921428a48a9b0e600072ae2282d71a6fe316add28de8a2688562ea4240ffb333d1c877abb5ca699e61ca21f6145d57b511c3cc1a77505bf2fb2e597c888cb8b933fd7cf8aed524bb8420e2a289482941d3b5537ab9f2c889e90927b75718960bfdca174a28ba7ba31d746fe4a4466bce57a48664b80cd5ac5b71"], 0x58}}, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r5, 0xc0389423, &(0x7f0000000140)={0x5, 0x0, [0x90c3, 0x1, 0xd, 0x2], &(0x7f00000000c0)}) executing program 5: timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f0000000a40)='./file0\x00') syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000240)=[@request_death={0x400c6313, 0x200000}], 0x0, 0x1000000, 0x0}) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) timer_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}}, &(0x7f0000000100)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r5 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r6) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r7 = syz_open_procfs(r5, &(0x7f0000000040)='ns\x00') syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef0109021200"], 0x0) readlinkat(r7, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000440)=""/163, 0xa3) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r8) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="2309fefffffffcffffff0100000005000700000000000800090000000000060002000100000008000a0004000100080017"], 0x3c}}, 0x4000000) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x80010, 0xffffffffffffffff, 0x42795000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) executing program 35: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="0f01c9c403e15fb1000000000026f247ab0f2052f2ad0f20e035004000000f22e02e45ff9e0c000000c443050295000000000f48b8e4000000000000000f23c00f21f83503000c000f23f8b8010000000f01d9", 0x53}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$kcm(0x23, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r0], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) executing program 2: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000001ac0)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000240)='./file0/../file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, 0x0) executing program 2: r0 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000280)="42f2d226dfbf55c6ebc9d4ba14698c2ec0416b3cb15f0b947b9e046bd3c42dcc8b201664bd37d5e1dcb2f64ec074a225ac13a89be79e2bd5bdcd8cffc5ee0512dfe666423022c73264aee90673292872b9ed8e53787dcf53322f00", 0xfffff, r0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) executing program 2: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) executing program 36: timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) timer_settime(r0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000140), 0x40000, 0x0) executing program 6: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(r0, 0x0) syz_usb_disconnect(0xffffffffffffffff) readv(r1, &(0x7f0000000800), 0x0) futex(0x0, 0x207, 0x4, 0x0, 0x0, 0x1) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000740)='team_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000014c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2, 0xfffc, 0xe652, 0x2, 0x85, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0xff80, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) executing program 6: r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200) syz_usb_disconnect(r1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000800)={0x24, &(0x7f0000000540)={0x20, 0xc, 0x4, "d4fea164"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 6: openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x1) executing program 6: r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000840)={0x1, 0x0, [{0x48c, 0x0, 0x4}]}) executing program 6: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) executing program 37: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) executing program 7: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000280)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000140)=""/248, 0xf8}], 0x1, 0x0, 0x0, 0xf5ffffff}, 0x10000) sendmsg$tipc(r0, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) executing program 7: syz_open_dev$evdev(0x0, 0x20000000000, 0x840) r0 = socket(0x10, 0x803, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000001000/0x4000)=nil) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000080)=""/108, 0x6c}, {&(0x7f0000000540)=""/35, 0x23}], 0x2, 0xa3, 0xd) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)={0x20, 0x0, 0x1, 0x70bd2a, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x20d3, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f00000006c0)=""/118, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x53}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000001fc0)=""/191, 0xffffffffffffff52, 0x500}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 7: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000002c0), &(0x7f0000000340)=0x4) r2 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)="48000000140081fb7059ae08060c040002ff0f03f1cd823010a7ce9000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a0200000046", 0x48}], 0x1}, 0x4000000) r4 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r5 = dup(r4) write$binfmt_elf32(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c464a030103ff0700000000000002000300040000003e03000038000000d600000097700000fe03200001000700080007000000000003"], 0x58) execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r5, 0x110, 0x5, &(0x7f00000001c0)=[0x4, 0x2], 0x2) syz_usb_connect$lan78xx(0x6, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0xfffffffffffffeab, &(0x7f0000000100)=[{&(0x7f0000000380)="6a44f1d6f6a697494db6c99178c0bf2d9875a672d60d559c1a5b185abb784d0395bc54976639ff16ee9697bd4b98cba5196ff2198eee6aa716b8230cd26d4d15dc8d144a25ca2071808fa35483f18ec26b26d05a7f468ee86e8759e4382afb69ee1205226af85ce1cacc5ad82a5f79fb2e858c8427b4d350ee8f65797a33d58ed42904747ce473655e939b3d07f55f94e09de425da3a77c990c6ddb8b579b65dea67099f821ace57015bb955e2030880e809185768e1bd77f4c3257fbe8b145a6f2e821138431601abb929af2000903fe2a8815339ab0746af341794441f931a64f5156f92c32d8ce3455b3833e0823adb7a88acdc4fabccc4384adde42b776508b995899ae8829f481e64865db3fde9a59db01a0fba1340f37943ac5386cdeb948cfc5b763f303843b6dfed2134c4b90163902222ba0a413cc95458789d02ab2c98d2bb20dfbba952455c74e41672e7f611043b4ef5ceecda800ba89a0ff583b333913bbe9b1cabde7d61e07cd95b4ba9ac6cfceca36771a645bbce65dc8b4031ee05624821328dada50972f203fe9452a7bdf892f465dbcc06d254ef7c875488a8a0461fd20116b19099915fb8215a88758ae818071442b4917c5e993ff4d8a6c52086837e822347087a815a6dfa755668c02f79e35f6c2a07b10282c92fd3dccb18eeb1a4cbff8d9e625d9d84ac085b6f50e7f90240d0527f8ec2381168865126cc7b0f528d8bbe5fb11b7bf908d300c4af70bda57f4410d13e7e52dc277f8b2bc1300f766e39dcb53c451aa66d22dcc770f846840c2c9397ef5b6129c7216a57f843e206a79a095c890364ddef6bf9b73286a34360191d1d313b0d07a2dc2be8e7fae2e53e1ca3a31284695a3d8ef95aa5674814383706f6d81c59caddf107fd44d336ecba55083e0306663082a4af24089451b3c94846d0b2dce03f18db2267f1e3c3b366e66b6f5b55467d3ff37a5903208caeba6f9d0b75d1bb5b22106c8d98f5e175e9de0e0f6aa6bd133b235d3349473b57ce70b3ac81f4b52ffbce9f5adc3c14ed49be00c645b9f8e25d0f71c1f0f328286e5bc56a5618d654e19670640ed202c75a412c0cd470c640915090697d345ccdc9824ee4de6fa68f53770182d6e8b4d3a72bfe3a805f7ee21b09270d7ffadc17bd1e6ef3498165aec1d217f23602bc7311ef72efd0223ce363a29cf203d4938ed26cd254396d2edb43f7258f40cc6f26e3a93882a38fee0bf0487adc02f6b5f6263295e650650b3646d11af5b51ca7794d7bede6e3f9511d84de549820678e402df61f5d977ba469dcaf3d82df28730d5c1b8ea24596f253260fec27a340d8919f40667718f6653b01f3260b94c1bba95998edffecf1ab17a6cbbdd98a849949e69023c9ddcf8349536d11629592696de57b16bd1f73f7b3c44e765c536e307ac915c5d21a34367f36e6b8120710c52a3e20ec5efcb6d0f8ae6a0cfb4d27da16090ed3a86a6eb0ba183816b0ef00b3dff1108ac86538dca104a9dfc1b250cb1440d132b03c0328aeb6f8d53ffb309fa7164abcd051e60511b71c4168d92f05fc43636e00b20934a469b4c9686d1326211991cb846fb46736ae43bcd500fe72ef6bf47b7600f56b158a7c733b0c126d233002e7d22c6b0c795822988aeefca0b4a5e013dd424522193fee354cdb036e35db3752a860fb5993d5d6667008836bd4277939bfdd539e952f52f8d322852517ae43e479fc8150a2c9fb4dcb73ddd5f3e0608fc51c45bb8808adc902adc071539fefce27d0440005ed039119f6e74532b62b4cc89900b30f8ee7b5683f162197603485212760b27572b03fbb3293be7f9adc2b6130b711f3091bf7a4f02f9cc3f4181d3d4f2781ecde756b5ff82b578150a4bd0cbd1b68d870a304bcfdc73d15d24198786934e585be27b9c63224590e03dcb413e8283be7a82781503adbf75f3d6f6f43717849c5f5f91e469dcae1f0a36875aaf31643baaeafc692bdb4d2191a692efbd57fd8871eb289f336e9292a429ef630539219cd4b7015cf8daa6fb1a418d0e4ff7f2886bbdbe039206f9241a1ad8c8b168ed69d8afa66a73d78a94f7e5ffcdc4ecb5f8edda92ffbcad77b4c49442a35de07b89774e4f103e81b57236fce4773be6d623f675c45ea6a3b009f49be4c66a274aeddb52b8571426af4a14d44cd915f8b53da1f7b0e58a817a8c1d7c7ac9d178d9cb46998bcd47cee3d181887db1753dbcfb7bfc6f482298a78835318e2fb0dd270d559efd801f261983cfd6661dc7fb4ce2c26e600572b2e41072b9713b2aca0b41b6b7639c0d6f84e972eef3bb1c9b921ea51b423cf7715f1016d1118d9b1213361fe0ba90e4650aad2012e31dbe2d0b748648d7179e288c913eb4d1a6bfffd2e8e80f4f28523d5904075ff6e481759a3d1ea8cd8eeff92a6b314131883ed3423913b84434e4d4690abd36d32fc407dc585e047cf66a6af671443f9d5fcd2bae0ea0b51e53c0d38fbac4f301656a0eb8010b90d6fdfff88cffc0483ab89b8e186a22e9da921edd870dcd69c66ac61fc0783b31c9c8ef4ad3f1b1b8704aae4fd21822d174f30dece2f5605bc40a81f682f65afb7642fb252e21e78a84cf75c0e64d86589c9a1429add1873223fb2400dd85ed8ea09cee938934f67492ffadc32c45d14dc4f406e4dc5a13cb0b93b135f1626ccab316c549578e9745a516b69daad2a05495814fe14d8e61a8b4e6701330d11d76a6ba2399ed2fa76be3aeef64ba828ec694a6f40209e9b5483c5849fe483ecb539ba25a97ce4941c2912577153404bf96bdc13caf7f1e422845689fc37fa198b59cbe0192e3634144817251284387335a7d98c1b78c9827e71f5ab7caa42ff9c95441b2537633d4a46606ae8bab9cb81cfdcfc8a6f3a7414d467ab08e168427d0fd6c9917f1a128a63287d3b3899927e19c3d9069efcbd7b18635375448bfe2c5c1219085a1a789b2ff11fafd7ffa349a0ba4c4a097551ecc01c0b65bf4ecb34ab7333dc433926d6bf88e226efea8d8a5d5b4b39dedae19334db8e862f0de3d82234f758160f9d69e84ed0c9af137fbf8880ae5a92ae91705071a44738926cf1f9cb819e77982cfffc875b3a71086701af6b5e03d1dacf60d89ab9a2c578cf0fedc1759d8127c933683672245300ef62effa911df814128457dbdb11923d92ff1c3a5429bcf95ff53b5e08ab2f99f82435671131c30038624524faf6cacc9d01a620bc15e48bb5d098dcf4a9ab38c2f38e1a68f0b678d83db88e78c38c8ba3585abddc8f31224f872d5855df2c72a3c7c15d2410212bed80bc5f68fa00bd79d94d8069896eb240b65114350d562e974f11982052030669a8b186910b30e8b9b0b880bad51a0679d4984ad5edec617c68ddcd610b4d1f10c33d6ceade2e729ea926eb50f978faf66898dfc08ba7b23afa275313c6876d1459aa916e38f914c23624b733013cb02739bd48ceb3ac10f8f5ba9a0e1b7b8f0b4f3eaec76912d0e0510a7e5596972142198fd277ec66228cab5e2d2fc263236379eca449d13a7acc9a945b4e2695e1896cd5c344b6bebc42dc5831396901a213eb44a25f3bb94170628fd7a0af03bd77f69c331a469ff2b9064b1560dcb380e038961c7cd82c97eefbadb3c4e4d44a94024f10ffcb04d8840f356e88d3811644d3deb7548cd945fdfd92a2775347563f3597e172ed3273f220b3da9ce252f131b1abfc91e04f56ca2c942cbe58b54150af091b6f4cc4fc6a888db50a290f8f1b4e3c4452b6552ede8c3fa75ee0255fa973ebbaa82278c1f1b86d00f2eef635750ecceb550417a5de960d415c6de0ff09434aca4145389c5e63f171023c778e9ce756c9ae8d027745a469ed775155a265cbd721d5b653a05a3dad56b7337178b476f51e59a7f94afbafe0568546d2008d4cc8bd6df8e4ba3a541b42b6e1d52652dade7a0b7c492bae3ba8d9cfb0012ea10f72a0ddd043204320ceeddb728ad31e4f9156d5e0be6e02a6c7c1b3e2047cb3486e0940d0d91bfadef53fd1bcf9e7cfecdd2b21910897d8a149899744cce00c8031e6638425d26a3265a4d33b547fb8855a92d83cbad07598416ff0816d07c2c98ea0a53c19124a5947fc1d74d08d7f093e82dffbd86754c44669443c4c5f1648a692237f29f9f59fea64b7800c13df65d354b4a9e0f19b3e38d78960a136ecc62302f9ab32aef5ef2f2e9360744aa8bac9dcd5712ef14d17e4ac461d42f16335312bb79aef7fe02371caf9c4706565a338c2000329f24a8029fd4f302d67e14c56b5a9005934452302f41c0cb4e65937dd36f5660da7f05e0c4e43f291fc601022ad2db78d412168d6b6f54b400c7de0be3a09f0a123724e9e23847293ccecae2209433c034b1a60d3f784160667f6a0edb7da7b4ba5b68e3a4466679d8254a5af21e2df4e4b7330d283f299e7dfcb502391211cc59635f90a0653d6f9cb7555b875d8772f73d6c0aea14ca3014e4058e60b79d1d4070df80c0be1f2bf6490ce193d4de3d45d778933ce3dc5529132f4fffb1ffdc526f6884261b7fed64c4877474541e71dd2124e19d4b9dc51d2e898c2b5e24902fddb891ced8649a2c5f9b1d63928996d9879dbcdefd556ac5e3fa07984e20cc8ce0b20cacfab1f241ad9515de0e578c41aaab8801beb4566a276ad38abbac0a638ca52655e62fd0cbd2aa4011e7c2d036b0be2cf0f8bbb812ee3b7dad03b302fd2e58a564e084aeda6d8550293f05d91fb611fa45656f5eb4843e1cc7bb03d86fefafbb7593e561693b3bf5d5ab0bf3585fad1d0f0263b8ef05d331fbb9d2b0bfc861b09a233f4c789ef3ef00061653d09b703e7e578dea9171b07ab8d5597e6311a9e8161835020b597af6227db52edcee60337dec7dad98e516dfa3bcf567aacfec012ca130aa65e1164da627f45d02f595b2c159c0c7e8fd1a20a1f82fcb7926b53be095626e4149c763868f1fb5b4c562286396256d721ce3834b5350101c15dc045112b22b6c2a6e6329d030b05be6ef5848250b832047faca61289c56a5f59e28f0a7b8d7b526899b03157ec6f9b27fa80f9bfd647b478f480d78faa1f5183ef8e162cceace46314e2916b2aaf10f557554f1279b05349101702961a4fdb7c8a1df387835dcc959997767b0971cb22fdf0d365f33c70ca90f653c1bd6726e3072014e3b737ef007fe04d722b6d2c655dd2feed74004569ad78faf00388af5756276b580caa96c53d10eeca58e20192ee96057889b8175684673ca326f8a35c20489d45655d2e33008edc1b1ea1eedcd1440564faea72ae34f5fc7f44db0529646180ec95d8f4e48918e397b26f8e5219f50bad5775256d8382b13ac6036944632e672b21bb67efe8768199095e784b908e83d77db3e9b7a6e1519bc932fc46b0563c8126047b7cc7f2e8f9a6977dae72b748e6cd6063eb2b4e927a59e94a2544e80742619b41664f2da970fc43992d50df646dd92ceb84dd98c59d34f8ba30c026006f379389a5a6f0fc7a5b35f993fca50939ed26d37acd44513621423c1e875c52d072b06614ccae7281c4287309b216abcf64e51aa6da501b7da2fd52b6bbabda49db1ad99a6b40695781fee9cffbad7e614355ee7892b9c02c5057dcfd4947d45b8e1c6bd6b3df17fcd8abf2742d106ed8d355ba6152bb2c08261b280ae57478f92b83d9b09f345761bc4d93091149da5e96adf3fb90176d7b7de38a2cd47b795bcd0c0cd4cfaa5d042794e96c7c41f54205af0cd5ea2346d814b55d395e5ba28d7ddcc44d910860966bf88b5773c5"}, {&(0x7f0000001380)="b5d51e87e674e4b13902d16d7c0d6fcbe1fdda2394408ed5a63f6dac7d4a5e19826a799a0462aa72bea05972620a86239bd2d2b77a9cd0a3f266afb44277b9a13b13364bb87ac2e4bb8fdc22072196b5408f6c2afe9c3da6bd6a369e801b291826295a95a33e1da016ac6397c843797b49492e896bbc462cb2f3a90c0bbe53f92e63e9b26ed783a75d7a74ecef3402be10ea870f0834ca9d1c7adaed1dadc798ffe7fccc06a0d464ff8ffa9442f4260fc2563a41a02e5775528085dce461ecfa70ed87289a255ae96ca5e9307da1e7082d73310b7ee1c65d7f7678c3daf30213e563903b0b4d84fccaf10ab519875ba033e30d63c63e647a02912e7e63bf9c"}, {&(0x7f0000001480)="f8438e88a5727122f0b9f3b28920f3995f366a7d26543f8c1cc6782965e4f04f805cd5ce06923eeba29b13a86b19817152f01c9e6b09eb0931e8f53988390c5378b3081665029f391706f1c49dbd1db8da2834b22159616a02946beeeef6182bbbbbbd79f627f0e3ae1fa6c37cc5598d78873f143b603943fc42fc351ca567ce26c74e09f03fe7e2b3d00d"}, {&(0x7f0000001540)="83d309daaee832b9a1f17719f5292128918ab8cc603f560cd93a013640ee1f78fe14b4ab3e8865fdd70841103f12580b2a69308b5d1dd155c7093c31b72d3c06d30b58c791f2a759d33ba196aedee53cf6a505eaccaa321d3a7cbfc09736821f7fbb166f53082630ef3f1f1b24f25ab05b9435c990ce6580a20c76a2f65deb1f51a02b2d9bef45f3057a33399351483614ee2976a3e6fb0ade6c61973fd3f772f0c51e2abad9f69b7cab67e49156ae1b26565c7636f5b2206625678c8a83b764fd59e581149f815e8ef7acdcf939c353933b3fc09d19635a5c32d77ea1dab9d0f3f34f4ffb4c4e"}], 0x0, 0x0, 0x0, 0x1f00c00e}, 0x9081) executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) socket$netlink(0x10, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x50040, &(0x7f0000000540)={0x11, 0xc, r3, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x14) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_DESTROY(r7, 0x5502) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xe, &(0x7f0000000300), 0x4) sendmsg$NL802154_CMD_NEW_SEC_DEV(r6, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000a80)={0x24, r5, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x18) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) syz_usb_connect(0x2, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x52, 0x15, 0x5d, 0x40, 0x733, 0x1314, 0x16cc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x1, 0x40, 0x7, 0xa0, 0xe, "", [{{0x9, 0x4, 0x3b, 0x9, 0x5, 0xc6, 0xc8, 0xf0, 0xc, [], [{{0x9, 0x5, 0x80, 0x10, 0x8, 0x9, 0x40, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0x3}]}}, {{0x9, 0x5, 0x5, 0x3, 0x400, 0xb, 0x1, 0x36}}, {{0x9, 0x5, 0xa, 0x3, 0x20, 0x0, 0x1, 0x2}}, {{0x9, 0x5, 0x4, 0x8, 0x200, 0x2, 0xff, 0xff}}, {{0x9, 0x5, 0x6, 0x0, 0x40, 0x7, 0x81, 0x4}}]}}]}}]}}, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001c40)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000140)=0x200000000) r3 = socket(0x10, 0x2, 0x0) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[]) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000000c0)=0x1) preadv2(r2, &(0x7f0000000000)=[{&(0x7f0000000200)=""/76, 0x4c}], 0x1, 0x0, 0x1000007e, 0x0) close_range(r1, 0xffffffffffffffff, 0x10000000000000) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_SETINTERFACE(r5, 0x80045510, &(0x7f0000000040)={0x65, 0x10005}) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000017a201fa54769fd02b3b92b3b0ee67b69df40a5ba2cafd021e9d2ffcb9e2c5e9c9222374fd6b3bc4ee70892d59a783766c84179124cb345f9c3a6b9e7aa806650731da0a6497ed1"], 0x14}, 0x1, 0x0, 0x0, 0x50}, 0x640480d0) executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @random="008000"}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x0, 0xc}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x30, 0x65, 0x0, 0xb, 0x67, 0x0, @rand_addr=0x64010102, @broadcast}, "2197704658f37cc5bfed5bbe29edc3be0c0dad392d66248a60dafe72"}}, 0x3e) executing program 4: connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x7}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x0, 0x6, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xf, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x101, 0xdd81, 0x60a0, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0xd, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x48000}, 0x8482) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, r4, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) executing program 7: connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000140)=0x8000) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x4000}], 0x1, 0x0, 0x0, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0xa0201, 0x0) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0xff51) executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='notify_on_release\x00', 0x2, 0x0) r2 = fanotify_init(0x8, 0x2) write(r2, &(0x7f00000006c0)="ff000000020000a2", 0x8) write$cgroup_int(r1, &(0x7f00000000c0)=0x202, 0x12) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2080, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_HYPERV_EVENTFD(r4, 0x4048aec9, &(0x7f0000000080)={0x3, 0xffffffffffffffff, 0x1}) executing program 8: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000001200010027bd7000ffdbdf25ac1414aa000000000000000000000000000004d5020032000c0015005907350009000000bdbc5e97b4c066632897a4352bb1a681b2a7444f2cf38cc135de1dd81e0f954d45cf2c8fb0738882f1cd77d2c120b7b7fd8bcd7c3c4691578ae3862db0c5a943baf92ac7cf9b460ca37737ee8d55f2456cf3fff40bf702b27507cbaf1e6517e8022d09e09016a10f4bddb8a1aef747574567afb8807f176fbfb98ab00ae945ce541829"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r1, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2081, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x7) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000002c0)={[0x2f, 0x9, 0x9, 0xffffffffffffffff, 0x2, 0x10000, 0x7029, 0x1, 0x8, 0x0, 0x6, 0x9, 0x4, 0xffffffff, 0xffffffffffffffff, 0x8], 0xd000, 0x40}) ioctl$KVM_GET_NESTED_STATE(r5, 0xc080aebe, &(0x7f000000a100)=@vmx={0x0, 0x0, 0x2080, {0xdddd0000, 0x0, {0x3}, 0x0, 0x1}}) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000000)) executing program 4: prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000180), 0x200000, 0x0) fchdir(r0) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x10005c9, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net\x00') openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x3a000, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000892e79106d042107259c0102030109022200010000000009040000000e010000082402010102000008"], 0x0) executing program 8: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x1938a00, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x301000, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000040)=0xdfe5) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x10000, 0x600000) ioctl$I2C_PEC(r0, 0x708, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000200), 0xfffffffd) executing program 8: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x806, 0x0, 0x4, 0x7}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r0], 0x20}}, 0x0) (async) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x4, @remote, 'hsr0\x00'}}, 0x1e) (async) sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937e, &(0x7f00000019c0)={{0x1, 0x1, 0x1018}, './file1\x00'}) executing program 9: openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat2$dir(0xffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x1) executing program 8: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1123102, 0x0) (async) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) (async, rerun: 32) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) (async) listns(0x0, 0x0, 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) executing program 9: r0 = syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) syz_pidfd_open(r0, 0x0) ptrace$setregset(0x4205, r0, 0x200, &(0x7f0000000140)={0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000180)={0x0, 0x0, 0x4, &(0x7f00000001c0)={0x1, "96e67ad2d329458afe83c914c4628900000016c0c2fa29d7004600"}}) executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="df0d0200000037b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000640)={0x40, 0xf, 0xf, "aa63c2a22a007afb3282cf2f77dfb1"}, 0x0, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @loopback}, 0x2, 0x2, 0x4}}, 0x26) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_load_code={0x12e, 0x59, {0x0, "0f01dff23e0fcec4a17dd7d566baa100b0cdeec42220f38b0100000066baa100ed3ef3410f0966b8f3008ec066baf80cb81809ed8eef66bafc0cec36262e450f30"}}, @set_irq_handler={0xc8, 0x20, {0x7c, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xdb, 0x2, 0x8}}, @out_dx={0x6a, 0x28, {0x265e, 0x4, 0x8}}, @wrmsr={0x65, 0x20, {0x8a5, 0x100}}, @nested_amd_clgi={0x17f, 0x10}], 0x139}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) bind$x25(r2, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r6, 0x1, 0xff}, 0xc) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) executing program 9: r0 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r0, 0x0, 0x0, 0x4080, &(0x7f0000001a00)={0x23, 0x1, 0x0, 0xa}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r1, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x100000}], 0xc4, 0x3000, 0x0, 0x9) executing program 8: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r0, &(0x7f0000000100)='7', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x9, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e1c, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) executing program 9: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x1938a00, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100)=0x7, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x301000, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000040)=0xdfe5) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x10000, 0x600000) ioctl$I2C_PEC(r0, 0x708, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000200), 0xfffffffd) executing program 8: socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000010008104687da3aa7143a0b8c81d080300000000000000a118001500060014000040a8002b000e00014006046109d67f6f94007134cf6ee0a000a0e408e8d8ef52a9bbc7c0b7a196e6f66112c88a2ddddbbb219c6c09136dd481c4a918d1bcf0f938ba3495169ea70948047ec4a5d060a517898516277ce06bbace6f177ccbec4c2ee5a7cef4260027836b0d17a54ef5d6d9342484286f95728886fffcc44841a6db702f071f468430dfe1d9d322fe7c0acfa5fefec64193071e9f00feffff16ac9609f4fb00"/216, 0xd8}], 0x1}, 0x4004) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000280)={0x23, 0x7f, 0x3, 0x1b}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) close_range(r4, r0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230686f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8040880) executing program 9: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xbc}}, 0x0) executing program 9: r0 = socket(0x40000000015, 0x5, 0x0) sendto$packet(r0, 0x0, 0x0, 0x4040, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[], 0xfffffee2) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xf, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x7, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, 0x0, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1800, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r9, 0x3b83, &(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x6, 0x800003, 0xc53}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3) gettid() executing program 7: r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x1411, 0x200, 0x70bd27, 0x25dfdbfa, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0xfffffffffffffd11, 0x4b, 0x35}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast2}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x7fffff) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4a) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r6, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x80000) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, 0x0, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 16 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$inet_sctp-getsockopt$inet_sctp_SCTP_RECVRCVINFO-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_STAT_GET-setsockopt$MRT6_ADD_MIF-socket$netlink-connect$inet-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CHECK_EXTENSION_VM-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_GET_LIMITS-request_key detailed listing: executing program 0: r0 = socket(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x1411, 0x200, 0x70bd27, 0x25dfdbfa, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0xfffffffffffffd11, 0x4b, 0x35}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast2}, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8101, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x7fffff) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4a) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r6, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x80000) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendto$packet-getsockname$packet-openat$ptmx-openat-write$binfmt_aout-mmap-madvise-write$uinput_user_dev-openat$kvm-sendmsg$nl_xfrm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-ioctl$IOMMU_IOAS_COPY$syz-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-openat$iommufd-ioctl$IOMMU_IOAS_COPY-madvise-gettid detailed listing: executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) sendto$packet(r0, 0x0, 0x0, 0x4040, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[], 0xfffffee2) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x3, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xf, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x7, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f00000002c0)={0x28, 0x2, 0x0, 0x0, 0x3a98fa, 0x800, 0x6, 0x20b4e9}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1800, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r9, 0x3b83, &(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x6, 0x800003, 0xc53}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3) gettid() program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$kcm-socket$kcm-sendmsg$kcm-socket$phonet_pipe-connect$phonet_pipe-socket$can_raw-openat$hwrng-close_range-getsockopt$CAN_RAW_RECV_OWN_MSGS-sendmsg$inet detailed listing: executing program 0: socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000010008104687da3aa7143a0b8c81d080300000000000000a118001500060014000040a8002b000e00014006046109d67f6f94007134cf6ee0a000a0e408e8d8ef52a9bbc7c0b7a196e6f66112c88a2ddddbbb219c6c09136dd481c4a918d1bcf0f938ba3495169ea70948047ec4a5d060a517898516277ce06bbace6f177ccbec4c2ee5a7cef4260027836b0d17a54ef5d6d9342484286f95728886fffcc44841a6db702f071f468430dfe1d9d322fe7c0acfa5fefec64193071e9f00feffff16ac9609f4fb00"/216, 0xd8}], 0x1}, 0x4004) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000280)={0x23, 0x7f, 0x3, 0x1b}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240), 0x80, 0x0) close_range(r4, r0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230686f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8040880) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-socket$nl_xfrm-syz_fuse_handle_req-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io-sendmsg$nl_xfrm-connect$pppl2tp-syz_kvm_add_vcpu$x86-syz_init_net_socket$x25-open_by_handle_at-bind$x25-openat$mice-syz_open_dev$evdev-socket$inet6_sctp-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST-setsockopt$inet_sctp6_SCTP_DELAYED_SACK-write$char_usb detailed listing: executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x0, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x10b}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="df0d0200000037b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000640)={0x40, 0xf, 0xf, "aa63c2a22a007afb3282cf2f77dfb1"}, 0x0, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @in, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @loopback}, 0x2, 0x2, 0x4}}, 0x26) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_load_code={0x12e, 0x59, {0x0, "0f01dff23e0fcec4a17dd7d566baa100b0cdeec42220f38b0100000066baa100ed3ef3410f0966b8f3008ec066baf80cb81809ed8eef66bafc0cec36262e450f30"}}, @set_irq_handler={0xc8, 0x20, {0x7c, 0x1}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xdb, 0x2, 0x8}}, @out_dx={0x6a, 0x28, {0x265e, 0x4, 0x8}}, @wrmsr={0x65, 0x20, {0x8a5, 0x100}}, @nested_amd_clgi={0x17f, 0x10}], 0x139}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) bind$x25(r2, 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r6, 0x1, 0xff}, 0xc) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r2, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_CREATE_ID detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x13f, 0x4}}, 0x20) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-openat$rdma_cm-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: socket$nl_rdma(0x10, 0x3, 0x14) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0xff7c, @local}, @ib={0x1b, 0x7fff, 0x0, {"0000000000000000000500"}, 0x0, 0x1, 0x4}}}, 0x118) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-write$RDMA_USER_CM_CMD_RESOLVE_ADDR detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings validation run: crashed=true reproducing took 3h2m1.078761087s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 Read of size 1 at addr ffff888035839011 by task kworker/1:1/37 CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Workqueue: events smc_ib_port_event_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] netdev_lock_ops include/net/netdev_lock.h:41 [inline] __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464 ib_get_eth_speed+0x180/0x800 drivers/infiniband/core/verbs.c:2052 rxe_query_port+0x93/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:56 __ib_query_port drivers/infiniband/core/device.c:2129 [inline] ib_query_port+0x16e/0x840 drivers/infiniband/core/device.c:2161 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0x15b/0x980 net/smc/smc_ib.c:388 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6501: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5339 [inline] __kvmalloc_node_noprof+0x5ac/0x880 mm/slub.c:6916 alloc_netdev_mqs+0xa9/0x1300 net/core/dev.c:12078 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3757 rtnl_newlink_create+0x258/0x7b0 net/core/rtnetlink.c:3939 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 13: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2706 [inline] slab_free mm/slub.c:6388 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6703 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 netdev_run_todo+0x1135/0x12b0 net/core/dev.c:11779 default_device_exit_batch+0x923/0x9a0 net/core/dev.c:13253 ops_exit_list net/core/net_namespace.c:206 [inline] ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:253 cleanup_net+0x575/0x810 net/core/net_namespace.c:706 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888035838000 which belongs to the cache kmalloc-cg-8k of size 8192 The buggy address is located 4113 bytes inside of freed 8192-byte region [ffff888035838000, ffff88803583a000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88803583a011 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813fe54640 dead000000000122 0000000000000000 raw: 0000000000000000 0000400000020002 00000000f5000000 ffff88803583a011 head: 0080000000000040 ffff88813fe54640 dead000000000122 0000000000000000 head: 0000000000000000 0000400000020002 00000000f5000000 ffff88803583a011 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6501, tgid 6501 (syz-executor), ts 133952776744 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3955 __alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5394 alloc_slab_page mm/slub.c:3295 [inline] allocate_slab+0x7c/0x5e0 mm/slub.c:3410 new_slab mm/slub.c:3456 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7321 refill_sheaf mm/slub.c:2833 [inline] __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699 alloc_from_pcs mm/slub.c:4775 [inline] slab_alloc_node mm/slub.c:4909 [inline] __do_kmalloc_node mm/slub.c:5338 [inline] __kvmalloc_node_noprof+0x6ec/0x880 mm/slub.c:6916 alloc_netdev_mqs+0xa9/0x1300 net/core/dev.c:12078 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3757 veth_newlink+0x277/0xe00 drivers/net/veth.c:1851 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 page last free pid 6501 tgid 6501 ts 133915413359 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x1185/0x1270 mm/page_alloc.c:2962 __slab_free+0x252/0x2a0 mm/slub.c:5738 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4608 [inline] slab_alloc_node mm/slub.c:4921 [inline] __kmalloc_cache_noprof+0x34b/0x670 mm/slub.c:5482 _kmalloc_noprof include/linux/slab.h:969 [inline] __netdev_adjacent_dev_insert+0x16f/0xa30 net/core/dev.c:8757 __netdev_adjacent_dev_link_lists net/core/dev.c:8849 [inline] __netdev_adjacent_dev_link_neighbour net/core/dev.c:8878 [inline] __netdev_upper_dev_link+0xa33/0xc90 net/core/dev.c:8938 netdev_master_upper_dev_link+0xbc/0x110 net/core/dev.c:9013 bond_master_upper_dev_link+0x1a8/0x2b0 drivers/net/bonding/bond_main.c:1717 bond_enslave+0x1f65/0x3b70 drivers/net/bonding/bond_main.c:2241 do_set_master+0x563/0x720 net/core/rtnetlink.c:3051 do_setlink+0xe7b/0x4670 net/core/rtnetlink.c:3253 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 Memory state around the buggy address: ffff888035838f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888035838f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888035839000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888035839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888035839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 Read of size 1 at addr ffff888035839011 by task kworker/1:1/37 CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Workqueue: events smc_ib_port_event_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] netdev_lock_ops include/net/netdev_lock.h:41 [inline] __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464 ib_get_eth_speed+0x180/0x800 drivers/infiniband/core/verbs.c:2052 rxe_query_port+0x93/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:56 __ib_query_port drivers/infiniband/core/device.c:2129 [inline] ib_query_port+0x16e/0x840 drivers/infiniband/core/device.c:2161 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0x15b/0x980 net/smc/smc_ib.c:388 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6501: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5339 [inline] __kvmalloc_node_noprof+0x5ac/0x880 mm/slub.c:6916 alloc_netdev_mqs+0xa9/0x1300 net/core/dev.c:12078 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3757 rtnl_newlink_create+0x258/0x7b0 net/core/rtnetlink.c:3939 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 13: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2706 [inline] slab_free mm/slub.c:6388 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6703 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 netdev_run_todo+0x1135/0x12b0 net/core/dev.c:11779 default_device_exit_batch+0x923/0x9a0 net/core/dev.c:13253 ops_exit_list net/core/net_namespace.c:206 [inline] ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:253 cleanup_net+0x575/0x810 net/core/net_namespace.c:706 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888035838000 which belongs to the cache kmalloc-cg-8k of size 8192 The buggy address is located 4113 bytes inside of freed 8192-byte region [ffff888035838000, ffff88803583a000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88803583a011 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813fe54640 dead000000000122 0000000000000000 raw: 0000000000000000 0000400000020002 00000000f5000000 ffff88803583a011 head: 0080000000000040 ffff88813fe54640 dead000000000122 0000000000000000 head: 0000000000000000 0000400000020002 00000000f5000000 ffff88803583a011 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6501, tgid 6501 (syz-executor), ts 133952776744 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3955 __alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5394 alloc_slab_page mm/slub.c:3295 [inline] allocate_slab+0x7c/0x5e0 mm/slub.c:3410 new_slab mm/slub.c:3456 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7321 refill_sheaf mm/slub.c:2833 [inline] __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699 alloc_from_pcs mm/slub.c:4775 [inline] slab_alloc_node mm/slub.c:4909 [inline] __do_kmalloc_node mm/slub.c:5338 [inline] __kvmalloc_node_noprof+0x6ec/0x880 mm/slub.c:6916 alloc_netdev_mqs+0xa9/0x1300 net/core/dev.c:12078 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3757 veth_newlink+0x277/0xe00 drivers/net/veth.c:1851 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 page last free pid 6501 tgid 6501 ts 133915413359 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x1185/0x1270 mm/page_alloc.c:2962 __slab_free+0x252/0x2a0 mm/slub.c:5738 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4608 [inline] slab_alloc_node mm/slub.c:4921 [inline] __kmalloc_cache_noprof+0x34b/0x670 mm/slub.c:5482 _kmalloc_noprof include/linux/slab.h:969 [inline] __netdev_adjacent_dev_insert+0x16f/0xa30 net/core/dev.c:8757 __netdev_adjacent_dev_link_lists net/core/dev.c:8849 [inline] __netdev_adjacent_dev_link_neighbour net/core/dev.c:8878 [inline] __netdev_upper_dev_link+0xa33/0xc90 net/core/dev.c:8938 netdev_master_upper_dev_link+0xbc/0x110 net/core/dev.c:9013 bond_master_upper_dev_link+0x1a8/0x2b0 drivers/net/bonding/bond_main.c:1717 bond_enslave+0x1f65/0x3b70 drivers/net/bonding/bond_main.c:2241 do_set_master+0x563/0x720 net/core/rtnetlink.c:3051 do_setlink+0xe7b/0x4670 net/core/rtnetlink.c:3253 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 Memory state around the buggy address: ffff888035838f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888035838f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888035839000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888035839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888035839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================