Extracting prog: 9m55.777142135s
Minimizing prog: 8m12.431896152s
Simplifying prog options: 0s
Extracting C: 2m44.771984359s
Simplifying C: 9m24.840234469s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30, 24, 30, 7, 2, 11, 30, 10, 30, 2, 20, 27, 3, 22, 9, 7, 6, 8, 4, 13, 4, 2, 24]
detailed listing:
executing program 3:
r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000240)={'raw\x00', 0x0, [0x684, 0x8, 0x8, 0x6, 0x3]}, &(0x7f0000000300)=0x54)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x34, 0x3f, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x14, 0x0, 0x1, [@typed={0x8, 0xd, 0x0, 0x0, @u32=0x4}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x7)
ioctl$TCSETS(r0, 0x8925, &(0x7f00000001c0)={0xd729, 0x6, 0x2c18, 0x7, 0x5, "f5103746453df8814a84c60a2e83314ef0bfb6"})
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000007c0)={0x28, 0x7, r4, 0x0, &(0x7f0000ff8000/0x8000)=nil, 0x8000, 0x757c})
ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r4, 0x0, &(0x7f0000000200)='~', 0x1, 0x9})
ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x2, r4, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xffff})
ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r4, 0x0, &(0x7f00000002c0)="0022f4", 0x3, 0x9ff})
ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r4, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffff8})
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f00000002c0), &(0x7f0000000340)=0x4)
write$UHID_CREATE(0xffffffffffffffff, &(0x7f00000004c0)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f00000000c0)=""/31, 0x72, 0xf6, 0x5f, 0x1}}, 0x120)
read(r0, &(0x7f00000003c0)=""/195, 0xc3)
write$UHID_DESTROY(r0, &(0x7f0000000080), 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000024000103000000000000000001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r4, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000002e40)=[{&(0x7f0000000040)=""/37, 0x25}], 0x1}, 0xd}], 0x1, 0x10000, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)=ANY=[@ANYBLOB='\a\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB], 0x28}, 0x1, 0x6c00}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2792f10d10501200002000000010902120001000000000904"], 0x0)
r7 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x404000, 0x0)
read$nci(r7, &(0x7f0000000100)=""/107, 0x6b)
write$nci(r7, &(0x7f0000000100)=ANY=[], 0x4)
write$P9_RLERRORu(r7, 0x0, 0xe)
r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x50, 0x0, &(0x7f0000000080))
r10 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0)
sendmmsg$inet(r10, &(0x7f00000073c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002ad001"], 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x300, 0x0)
r11 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="18000000760001"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000005dc000400000000000800020020000000080005007180bbda0500060008008110a6bfdb43f6c97a374d38134aa00000"], 0x38}, 0x1, 0x0, 0x0, 0x4004800}, 0x0)
executing program 1:
r0 = syz_open_dev$video(&(0x7f00000001c0), 0xa7, 0x0)
ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x8000, 0x1, 0x50323234, 0x3, 0x8, [{0x3, 0x10001}, {0x54, 0x8}, {0x6, 0x7}, {0x2, 0x3}, {0x11, 0x5}, {0x2, 0x10000}, {0x5, 0x400}, {0xc, 0x3000000}], 0xd, 0x7, 0x8, 0x1, 0x7}})
syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000001000010700000000000000000a000000060001001400000008000a"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000000)
r2 = memfd_create(&(0x7f0000000280)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\x8b\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\x1c)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0)
execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)
r3 = fsopen(&(0x7f0000000040)='nilfs2\x00', 0x1)
setxattr$trusted_overlay_upper(&(0x7f00000006c0)='./file0\x00', &(0x7f0000001d00), &(0x7f0000003a40)=ANY=[@ANYRES16=r3], 0x1015, 0x3)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0)
fsmount(r3, 0x0, 0x1)
fchdir(r2)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100))
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r5)
sendmsg$NFC_CMD_GET_SE(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r6, 0x325, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x10)
r7 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65)
ioctl$SNDRV_PCM_IOCTL_REWIND(r7, 0x40084146, &(0x7f0000000400)=0x934)
write$snddsp(r7, &(0x7f0000000200), 0x0)
ioctl$SNDRV_PCM_IOCTL_DRAIN(r7, 0x4144, 0x0)
mount(&(0x7f0000000240)=@sr0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='msdos\x00', 0x180008, &(0x7f00000003c0)='.-(+]:(\x84X-/\x00')
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mmap(&(0x7f000000c000/0x3000)=nil, 0x3000, 0x2000001, 0x10, r0, 0x0)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r1, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x4, {0xa, 0x4e24, 0x6e1, @mcast2, 0xc}}}, 0x32)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_IPV6_DSTOPTS(r4, 0x29, 0x3b, 0x0, 0x0)
setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303, 0x3a}, "c4d65ab71f5ef2fe", "9e8ecc7bb5352776725e104757e7dc25c6519a85ef828f711330ff2bb17b5508", "dc5db43f"}, 0x38)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r7)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000440)={'wlan1\x00', <r9=>0x0})
sendmsg$NL80211_CMD_ADD_TX_TS(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="010026bd7000fedbdf256900000008000300", @ANYRES32=r9, @ANYBLOB="c5c13834175e281a2a326efa50d4893393c18356a980e7e5c9439fd839c677f807004fe1e6bdcad992952a0425b2d9ae069423909e17ade63b9d65a2c9171ef6103acf7b499296273c482e4ee4d96211a0ceeaca5c1d27fa8250b19d6439e68c2c6644df56aced1eb9978099f930341426a61abf9525dae426272530ff565c377e8e"], 0x1c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000044)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r10=>0x0})
sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYRESHEX=r6, @ANYRES32=r10, @ANYBLOB="060095000100000006009500018000000600950003000000"], 0x34}, 0x1, 0x0, 0x0, 0x24004044}, 0x80)
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
r11 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r11, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0)
read$FUSE(r11, &(0x7f0000006380)={0x2020}, 0x2020)
r12 = socket(0x10, 0x803, 0x0)
sendmsg$nl_xfrm(r12, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000001e00010026bc0000000000000000000000000000000004"], 0x40}}, 0x90)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r5)
executing program 2:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async)
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xde, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x5, [{{0x9, 0x4, 0x0, 0x0, 0x81, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x28, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0xa, 0x11}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0) (async)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x7, {[@global=@item_012={0x1, 0x1, 0x8, "1f"}, @main=@item_012={0x2, 0x0, 0x8, 'Q;'}, @local=@item_012={0x1, 0x2, 0x5, "94"}]}}, 0x0}, 0x0) (async)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0)
syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x31, 0x68, 0xda, 0x20, 0x421, 0x3e27, 0xe288, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x2b, 0x2, 0x0, 0x2, 0xfe, 0xa1}}]}}]}}, 0x0)
executing program 1:
pipe2(&(0x7f0000001cc0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@uname={'uname', 0x3d, '\xd0\xae\xde\xc1\xaa \xff\xd8\x1d\x1b\xf8\x93)!|\xb0X\xa3\x96\xed\xa2\xab@\xa2m\x93\xdd\b<\x00t\xdc\xabl\xab!\xae\x16\xc4\xcd\xf9{\xdc5_;A\xd2{eC\x014\\\xb3\xc4\xce\xc3yS2-\x01\xbe\xaarW\x96O\xd3\x0f\xe2\xd7/\x17\x1d\xa7.8\x9f8-\xea<\x8d\x91\x90j\xea\xd5\xd5\xae\xcc\xc0\x97\xef\x10\x92\xea\x98|+\x00\x00\x00\x00\x00\x00\x00\x00'}}]}}) (fail_nth: 2)
executing program 1:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="401724"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000780)={0x18, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="201101000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, &(0x7f0000000340)={0x14, &(0x7f0000000240)={0x20, 0x6, 0x67, {0x67, 0x30, "ecb66747153a2d55fedd0051fe038c986d080000005e4ddf88bf5cf90f5d400c2f53bdc0035a7e7c080000922355301d7070dd449a40e716fc8b8c681c64a9780f695e77500b13f37c63232c2d28bb827cafd6697932731cd6198d6e35d8d9b59896087f38"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x340a}}}, &(0x7f0000000740)={0x34, &(0x7f0000000380)={0x0, 0x6, 0x1d, "f9075a75d5140c282421827daee53fc871b89981e69bff431ecc956a8e"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xfd}, &(0x7f0000000440)={0xc0, 0xa1, 0x4, 0x6}, &(0x7f0000000480)={0x40, 0xa0, 0x4, 0x2}, &(0x7f00000004c0)={0xc0, 0xa2, 0x2f, "7ff578a19bfb688b1e18d2572d4495736373f5d10d1209ebabb8564294403fbfbaf64100c7b2bfd2818edf5e548de8"}})
executing program 3:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfffffff4}}, 0x0)
sendmsg$key(r1, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[], 0x70}}, 0x0)
sendmmsg(r0, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x24040, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x3)
ioctl$TIOCSWINSZ(r3, 0x540b, &(0x7f0000000000))
epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r3)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f00000002c0)={0x48, 0x6, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7b})
ioctl$sock_ifreq(r1, 0x8919, &(0x7f0000000000)={'veth0\x00', @ifru_mtu})
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
fsopen(&(0x7f0000000180)='ramfs\x00', 0x0)
prlimit64(0x0, 0x7, &(0x7f0000000040)={0x4, 0x5}, 0x0)
timerfd_create(0x0, 0x0)
r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r4)
r6 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io(r6, 0x0, 0x0)
syz_usb_control_io(r6, 0x0, &(0x7f0000000980)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB="200556010000b0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
sendmsg$IEEE802154_START_REQ(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x24, r5, 0x1, 0x70bd31, 0x25dfdbfb, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x24}, 0x1, 0x0, 0x0, 0x18800}, 0x0)
r7 = socket$netlink(0x10, 0x3, 0x4)
write(r7, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29)
r8 = dup(r7)
read$char_usb(r8, &(0x7f0000000080)=""/139, 0xfdef)
ioctl$SNDCTL_SYNTH_INFO(r8, 0xc08c5102, &(0x7f0000000380)={"88e0f1e8bf20175037fc3c01f75ec954d81b3151d9b2d092edc7f80f70df", 0x10000, 0x2, 0x1, 0x9, 0x0, 0x3, 0xffff1665, 0x1, [0x0, 0x100, 0x8, 0x7, 0x7f, 0x7, 0x8000, 0x7f, 0xfffffffd, 0x8, 0x86b, 0x7, 0xfffffff2, 0x6, 0xb, 0x9, 0xd0, 0x7, 0x3]})
r9 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000), 0x8)
r10 = socket$packet(0x11, 0x2, 0x300)
bind$packet(r10, &(0x7f0000000140)={0x11, 0xd, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14)
executing program 2:
ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x0, 0xa, 0x0, 0xa, 0xfc, 0x0, 0x0, 0xfc, 0xfe, 0x0, 0x1}, {0x5000, 0x8000000, 0x3, 0x1, 0x40, 0x3, 0x4, 0x9, 0x0, 0x0, 0x0, 0x42}, {0x3000, 0xeeef0000, 0x0, 0x8, 0x0, 0x80, 0xb, 0xf, 0x4, 0xe, 0x84, 0x3}, {0x100000, 0x0, 0x0, 0x0, 0x1, 0x3, 0xff}, {0x11000, 0xd000, 0xc, 0x0, 0x0, 0x80, 0x94, 0x0, 0x2, 0x0, 0x1a}, {0xd000, 0x8000000, 0xe, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x20, 0x0, 0x84, 0x2}, {0x8080000, 0x80a0000, 0x4, 0xf0, 0x0, 0xde, 0xfd, 0x6, 0x1, 0x0, 0x20}, {0x1, 0x10000, 0x4, 0xf9, 0x0, 0x70, 0x4, 0xc, 0x0, 0x2f, 0x20, 0x40}, {0x6000, 0x4fe8}, {0x8080000, 0xfffe}, 0x0, 0x0, 0xdddd1000, 0x0, 0xb, 0x0, 0x900, [0x5, 0x8, 0x0, 0x3fffffffffff]})
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = eventfd2(0x2, 0x0)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x7, 0x2, 0x2, r2, 0xb})
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x2, 0x5, 0x0, 0x4002004c5, 0x1000, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2], 0x8080000, 0x1144})
ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 6)
executing program 3:
r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000001c0)={0x0, 0x1, 0x5, 0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x4fceeeaa7ddace38, 0x0, '\x00', @string=&(0x7f0000000300)=0x4}})
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f00000009c0)="12", 0x1}], 0x1, 0x2, 0x1, 0x0)
r1 = socket(0x1d, 0x2, 0x6)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x10000)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
r3 = userfaultfd(0x80000)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000400)={{&(0x7f00007a7000/0x4000)=nil, 0x4000}, 0xb})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r4=>0x0})
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000180)=0xa, 0x4)
socket$unix(0x1, 0x5, 0x0)
r5 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', <r6=>0x0})
connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10)
sendmsg$can_bcm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0x20000600}, 0x1, 0x0, 0x0, 0x4000}, 0x4)
bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r4, 0x1, {0x0, 0x0, 0x3}, 0xff}, 0x18)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4801}, 0x20044810)
r7 = socket$phonet_pipe(0x23, 0x5, 0x2)
getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x9, 0x0, &(0x7f0000000740))
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$EXT4_IOC_SETFSUUID(r7, 0x4008662c, &(0x7f0000000140)={0x10, 0x0, "8e3c8b54b42cd92efdaa0e07f8e011f5"})
capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x10000000, 0x0, 0x4})
mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_NL_NET_SET(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a00)=ANY=[@ANYBLOB="f2142ab5f0af551396cd6bcf23c8ce4bcc416d49ef8a9bc27a991c0ce83ff73151518690d423b44669f9900fea920986f131a6a3fff094bb38961d72800fe414fdaac80772f6dfc6dc8103ceeb682dd4a64a1fd6aa0c69d9748367b027f98b6a4b46c1a3fae978a7c06e5a69a53e505d86ca3b9b1bf1fa731663d358f2b3f75f476764d3fee8b1caf630742c5c698e45425ff6902eb4e8369c1fd44a800eb37cc179a6f1a634c28a2920fdc9a48daf472c6b09275a7b1279a2b7fc38c1a5d3b8d5c61d3bc9220ec5a2648688905c7d1ec11824677aac6658dbc4e826e0ae2b1337b96d28e04f71fea9c699595870", @ANYBLOB="64e6afca3e05bfa47bf80a903e55365b71197c1bd24c42fdf0b37805cb0833e7a5bdf205f183fe02b67eb6b07397874a788b227590bd8f5c3583bad1ab54e85063b6740196e609ddf1511d0b5a57828bc79485b320548e7f3d81253d1034897c03b0ae21067cedf27d0240a65d1cf135e9cbce162f601d6514f703c9f1d64088d8b4ba89a24622d1502670e4232c43603c0f3fd43ecf7abe90fa1c2534d62a35fd7f626a93f34afe76a77a5a9fa0c4c9662f7de3f128ea", @ANYBLOB="010080000000fedbf3250f000000"], 0x14}, 0x1, 0x0, 0x0, 0x2805}, 0x0)
sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00cbf4fbfff3e1c4ee00020900010073797a310000000028000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000111f01f9a8122209a8bb5da1a4d9b4bd4c7adcc5604510e03a361ccc991a1e7197422d76fba5495a521b91387dc87aa06a034c974e3ef9f5b09b10335d927b03d782536a0f6663794676a0c940db7a70500f254eca4a49158f1c75d9c8b7f8d5d4891e248fcf683c72529a73f9758cea1a13bef6d74b226c13d3e0f057dd61a63db141c1827a812cee2006ba0ca0c2655918ea85842fb08dbe27fa411e0f95fcdd631605000000111ed4d03e7abe88ac687267b9e04764c95a68b83f33668f379ca6df17c8e42e29e7d94db1b2e87bfe7ff1339f122a27c30ad718ee0f3099d16d3dc25331e584715e01148cff91d980f5f631b974cb59d6f70b4469b88f66e754a0a949f69b031bcaedf0147651ffe5e5ccaa6896f3c55e335cbb332740945ca070391f75f8266f444f3444998a8e04b6db554679d2a3b7a3f75fca"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
pipe2(&(0x7f0000001cc0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@uname={'uname', 0x3d, '\xd0\xae\xde\xc1\xaa \xff\xd8\x1d\x1b\xf8\x93)!|\xb0X\xa3\x96\xed\xa2\xab@\xa2m\x93\xdd\b<\x00t\xdc\xabl\xab!\xae\x16\xc4\xcd\xf9{\xdc5_;A\xd2{eC\x014\\\xb3\xc4\xce\xc3yS2-\x01\xbe\xaarW\x96O\xd3\x0f\xe2\xd7/\x17\x1d\xa7.8\x9f8-\xea<\x8d\x91\x90j\xea\xd5\xd5\xae\xcc\xc0\x97\xef\x10\x92\xea\x98|+\x00\x00\x00\x00\x00\x00\x00\x00'}}]}})
executing program 3:
mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
r0 = syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x101440)
ioctl$EVIOCSCLOCKID(r0, 0x40084504, &(0x7f0000ffcffc)=0x2ff)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x19})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x5})
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x4, 0x22ed42)
ioctl$SNDRV_PCM_IOCTL_INFO(r3, 0x81204101, &(0x7f0000000280))
r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[<r5=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, <r6=>0x0})
ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000440)={r6, 0x0, 0x0, 0x0, 0x0, [], [0x7, 0x0, 0x0, 0x80], [0x2000000]})
ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000200)={r6})
close_range(r2, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
syz_usb_connect$uac1(0x0, 0xb1, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001", @ANYBLOB="8528c6"], 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0))
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58)
setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x2009)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xf, &(0x7f0000000040), 0x4}, 0x4000000)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0)
close(r2)
socket$kcm(0x10, 0x2, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8b32, &(0x7f0000000000)={'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}})
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b0f, &(0x7f0000000000)={'wlan1\x00'})
r3 = socket$kcm(0x2, 0x200000000000001, 0x0)
sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085)
sendmsg$inet(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f00000001c0)='{', 0x1}], 0x1}, 0x8000)
r4 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000180)={<r5=>0xffffffffffffffff})
sendmsg$inet(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000200)='R', 0x1}], 0x1}, 0x0)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)="b8", 0x1}], 0x1, 0x0, 0x0, 0x10000000}, 0x0)
syz_usb_connect(0x5, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0})
connect$phonet_pipe(0xffffffffffffffff, &(0x7f0000000200)={0x23, 0x20, 0x8, 0x9}, 0x10)
pipe(&(0x7f00000000c0)={<r6=>0xffffffffffffffff})
sendto$inet(r6, &(0x7f0000000140)="8ed4e1", 0x3, 0x8000000, &(0x7f0000000180)={0x2, 0x4e24, @broadcast}, 0x10)
r7 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, 0x0, 0x20040841)
ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000080)={&(0x7f00000001c0)=[{0x1, 0xb210, 0x0, 0x0}, {0x9, 0xa200, 0x0, 0x0}], 0x2})
setsockopt$kcm_KCM_RECV_DISABLE(r4, 0x119, 0x1, &(0x7f0000000240)=0x3ffc0000, 0x4)
executing program 2:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1)
sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)='%', 0x1}], 0x1}, 0x10000000)
executing program 2:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000080)=0x1, 0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r1=>0x0})
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = inotify_init1(0x800)
r6 = fcntl$dupfd(r4, 0x406, r5)
connect$pppl2tp(r6, &(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, r6, 0x2, 0x2, 0x4, 0x3, {0xa, 0x4e22, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2b9d}}}, 0x3a)
setsockopt$inet_mtu(r6, 0x111, 0xa, &(0x7f0000000000)=0x3, 0x4)
socket$packet(0x11, 0x3, 0x300)
bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {0x0, 0x1}}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0x0, 0x1}, 0x1}, 0x18)
sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180))
fdatasync(r7)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'vxcan1\x00', @remote})
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000202010400000000000000000a0000003c0002800c00028005000100000000002c0001"], 0x50}}, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8a, 0x61, 0x6a, 0x8, 0xc98, 0x1140, 0xf021, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x4e, 0x0, 0x0, 0x3, 0x9a, 0x3e, 0xc}}]}}]}}, 0x0)
executing program 0:
pipe2(&(0x7f0000001cc0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
r2 = socket$inet(0x2, 0x3, 0x4)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xbc, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x50, 0x11, [{@in=@loopback, @in=@private=0xa010100, @in=@private=0xa010100, @in=@rand_addr=0x64010100, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x2}]}, @encap={0x1c, 0x4, {0xfffffffffffffffe, 0x4e24, 0x4e23, @in6=@private1}}]}, 0xbc}}, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10)
sendmmsg$inet(r2, &(0x7f0000000600)=[{{&(0x7f0000000380)={0x2, 0x4e01, @local}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x20, 0x0, 0x7, {[@rr={0x7, 0xf, 0x4, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @broadcast]}]}}}], 0x20}}], 0x1, 0x46000)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="24776664f81b233b2d6e04aaa880fbe2702328831a98b79dac807af7bf0cb81de23215470959d6db2533ea32b6846b7ac25ce4bbb5ec7246a19f287521c7f852d6b82b141c2d609b2fcc17355cb63b6fc139b6b2badd7acbbd20fd1b69abc59b9c9f44856e2969d68493b2784ebfbad4d489cfb4ec7564bbe023c49956752bfe9df98aed0a53bebcb5", @ANYRESHEX=r1, @ANYBLOB="2c756e616d653dd0aedec1aa20ffd81d1bf89329217cb058a396eda2ab40a26d93dd083c0074dcab6cab21ae16c4cdf97bdc355f3b41d27b654301345cb3c4cec37953322d01beaa7257964fd30fe2d72f171da72e389f382dea3c8d91906aead5d5aeccc097ef1092ea987c2b00000000000000002c00"])
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e24, @multicast2}, 0x10)
sendmmsg$inet(r1, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10, 0x0}}], 0x1, 0x2000c000)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x25, &(0x7f0000000140)=@gcm_128={{0xcf05a145b37f58f3}, "2034b251822b3a46", "fa6b72def4acb1a6c86918c638857983", "34b3adec", "6745ac421772258f"}, 0x28)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1)
sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)='%', 0x1}], 0x1}, 0x10000000)
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0x19, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x7, r1, 0x0, &(0x7f0000ff0000/0x10000)=nil, 0x10000})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r1, 0x0, <r2=>0xffffffffffffffff})
ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x8, r2, 0x0, 0x0, 0xffca, &(0x7f0000000040)='?', 0x5})
executing program 0:
r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x2, 0xe})
ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f00000000c0)={0x2})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0)
ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000080))
r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x300c0, 0x46)
open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x0)
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002040)=""/4096, 0x1000}], 0x0, 0x0, 0xfffffe2a}}, {{0x0, 0x0, 0x0}}], 0x400000000000059, 0x2040, 0x0) (fail_nth: 10)
executing program 2:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0xc00, 0x56, 0x9, 0x800000}, {0x7c5, 0xff, 0x0, 0x9}, {0x7, 0x93, 0x10, 0x2}]})
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x5, 0x10000000}}, 0x400040)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x12, r2, 0x0)
ioctl$SG_BLKTRACESTOP(r2, 0x1275, 0x0)
r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x80044941, 0x0)
ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140))
ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000040)={0x5, <r4=>r1, 0x2})
ioctl$EVIOCGLED(r4, 0x80404519, &(0x7f0000000200)=""/98)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = socket(0xa, 0x5, 0x0)
setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x83, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 3:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000001440)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0xa}})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
listen(r2, 0x1000)
getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000000000000458000b480400945f64009400050038925a01000000000000008004000000ff", 0x3d}], 0x1)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
r4 = socket$packet(0x11, 0x2, 0x300)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'gre0\x00', <r6=>0x0})
setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4)
sendto$packet(r5, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @multicast}, 0x14)
sendto$packet(r4, &(0x7f0000000440)="1df1b43c99c11d021b4b0233302df5d3e3babdd02abc52a1bb65d50484e516f8529c11c7b7eadd4c66ed54a772fae6ee6b60db7043b3cff3d1080f9494b06cd3b2425cd96acad4ed347f6619f1c14c71fdc7035b5b9e554eac80a6b66cc5bdcdfefd6c796ec9327e5f905647405a6d9bcdc81e6a03861838e2483acacaaf74be0fc33fba2935ebf00066a6f98dac5876c7ec2e6d74419a5b4febb3f30a3c9ab2520613ad3796ddb020f23d54d8b3037031242757d39ea9dc9e287393b6fc990693c52332970e12b4a7e26d2377932a52cb1ff09c69fa1e1d249d78376ee97816a31d834fa2c5a8b432bdce6e5576ad7f0dff33a2c7513e18d930cb5afc6ae2ee9ea0b9711af65353e39092a1c748ea73ad4f5df985fa24a3af6577f283662c633f20e0de1987a31773db91a7986a6db630ec2ebe1623d2287d883e6d76eafb04efb0bed270230e8f6463e60f6967720af2e43209d777636de33548e7c7c7b3fd93d0e990bc350652cc677691901dfcf5e7dc99e5e3cabda41b8bacd9fa8404decc31c3908e42908d92b6d947ff329866face99b4daa8e524c9d909b0de54038a54852d9ccd4f1b8a3d86957f222621dbf76074291517dba8d4e4bce89f42dea6c63fdc638e7a57cdaff25cc4acb30e02ddc96b25195da544ce508f3d47a024a6dc301f888caeb2da391bf6c7e6a4bc84bf57aaaadf8a2905cebb447f183c61bc6efb9eefb36148db88971012f0c77c9ba4e9c198077a6a78f18b88ea80f043b730f5be95245a7308d72f793df349e403641f8509f47950f538ddd9f803f9e5d9ccb8021f6d478195f94cafb4280762d55012caa3d17ee5fb53fc7ddfac2c6d90fca621cccbf47a7eb9e5697814bd9a97b850a0144d0fd7c1b7a26cfa76a7154e92f9a450cfc11624926f321fd3e172703fa7a106445d356195a14a6df76c054ba956a8037fae9519a330f2fa712bc5005157e0893a229dc80ae43c0144dff420d863dae3f347953b382b2bfc430dddac6fe5a9dfeaa6b23a16e9bc267421721dc61c83945a054ea6ab744a1ceaa017eb920a9e93c9260902c6ec0f010381570e8ad204e241bd3a4af70b101d331bac92e19653718d5c3de603fb2ac60f89cd1060c71b58a61a2e115a5faf007eaa430ed62191278f427798a55067e8276b608820e76e28ce9d2d83b3064b2e6fb079f3d9005aca71ac605bc6c4a7ac1f0af600760a83e49924d2c98be59d4528979f1bdf5a9fa6c7ef9829e431d8eddf4021dab7982fb99cf0264a9d49490464e45d453bc0b8ba73a1ea94add1dca90acee66220fd7a112952ed9ac57cb1b4d46a76f72fdb607f7be21c794fec17bac1252959d03be89dbf41756a308075cd1e41d5dbfd7148beaeb1ecb1c6e504258147eba9dd327537217a3445f0f030bc590d886dec5fd15d3d4029177fb4242970ed2a6b70c0a76be3e5b047895b6c3227255c4e6ffffc1afa1c650f2eb4f3af5f11c273d1bdf9e1ece42aecd85fc0d67a1e8baad9ccec35b64c5ffc62e99cf7a0a2501f3ff5aa1dd6421cb1b39c174d8ce3ef1fdfcb924eb2f8a2fb3ef886646ad06de7ef77ef0e2bb987e8f2d6d797739ba69aea37a28b5f039dc45414d01d366b4ed0109eefc3013af76f585e6ecc36c34386f93ca12432ece65e2876414cfd4abd2afe3ee02502f537e3e15c8605b06da33674eba04b900f4d4197435c5ee042fa739e51a72b73f561d65eb9642c785bbce1a9715035ac96022c0c9c7bec74349067d4a2c2187fc5d57f20f905d807f3b72b517f38ba9557dccae63b5d28285e5831c49463500cd359cc4872ae965536ee7cc25049e18e80adbb2bc55db1121b4635b24ae3ef6290579e3a59b136bc3cbe31587b9de4889f1e41d6958634f7ec3c51c75d60473a04f20a70ac068797b78ee32add897444df44e39ec39e1bcee3f27af2e4aed30bed439a064e15b98017634e7d42e97d6b69a08be31d9de72041ac0761068f49a68d14f72304144ec8797a24f2a2c67f0679d29dbfc0469637964c646e676470c1606f9a6573a5b0fd763d972b590851d16250fda88808a50fa66d1a41f8d0397063d8d926348884f57f5ddacd3ef86f1a0b1e450737a6446c9935747ad92aec26d2e1a07655a0dfd0d27acc288c5c35b9695a8250fda210a6ed56d828cb91620d83f2a14698ef32929f56880c2414de32294ca9b8602c6fbc7e8fbfb7aaee092303eade3ca1937cf3e7f744a6fa0892a04f411e843f7f327ea8e69c63ceb2be5ebce40f310751df41805928b198bb9e87631c72be95d67774c123fea3d1496d59f527cd3f0af5c5402a31617aefffa8f071fc714efafd75cb428a340c7724d562965679eba3f41705aceb86d34e3b4595058a76e1c0fbb5f11899ba1a9cc09cc1232b863ad70dd37a27b62b3000b61769645cae92ebd710816a5d2d0e1b67340b594a43d3801f7c41b6415851e3832f3d0d272deef652bef044506e78bc01f9a9127b77a37603dd08af1f2eb11cfd5dd90d310917b8a29e2a8efd780b09b25e2bf04d3bdfd702527d4a24cac4c91722715ac489e4a3f6cf758c12f5d9b44f87d394ffab621d8ca5cb795f393008e09a9f2630f77ab78d07b0844fcbe66813885776cf62178917862636d3381c9c8848163b86cb4a8f2f7a3e9ab11ebd14e8c771e13064e46c2c2bad633ee64fedb3d8ed07b053939cbc07e1875fe4ac5edf6139470f36caff31bab28974e2b0a95bad7580d72c0e71d8ec0441feb3e33495754a880ffb23e747926d7ffcc398a410057c0606c949d8f2dbb66ca2a910ded4c104acfe62fca8a55727e4b9db6ff798d39eabe52d61706740bdedbda35ee12c29bd51054b3102451a386b6942113f3c07737cb03b37e90c3a7454148d96168cbfbe49a7977dbc689f14682528d1135b84c07cedf5c3e77c12f9eb6565c2950288854a34ebbe6d28ec4fd267e033d1236a93f2d906e20862f83e00eeda125bf4066d81c6a74d1a975eda2a517858429eccf2b2f9205fb99abe737c0ffc04adfe95cb09dccd6339c1c1199523bd42d1f31bf0be8ae9c511dce9a93d22f5913df6d6dcd8e5ecf42719afefd8cb06deb4f080b17a6694754932af639926d8b06268ba695990093360511a6c5e6aaf4b9ed21cd966face90f95fbc54907e9f95e21169faa4d445d43f9e3306e8ce1c980f87c433001d4d5dfa1e709ab119c55293cdfa69f525d0d155886deca97490f19927c22e47c8e60b2cb83732d12583dfd2dcfd2a9e02ea1245bc86622a80448e4c2df6231af73a8255ccea0a72953344394866dd0bc0c175e264bec83b43b64945c54095ad7722e2102b19309f41df9d35cbcd7d0e6a7d7ce5e56aa85e2f9ff610b8ce139f8add5fefb8c1ecd7a35c810aa1c9bd3fedd8f7620c17099846d4c51ccf6ff09093c1715909364e2c8afc729259c7aff069ed0751b6a862097652fe71d896fc0dd05fa4822ec9343fa4b16ff23d48f680dc7d1e8dd058e636d1427439ab7ef5f024da9863da8fb41d7c27c4346644fe0acbdf3abd240d1f9277cd8d49baff71abf768e190477fbb66cc7a7b7871c00c4337e84d8eb5d0fa0f93c96eae41427b40223341aa428cafea5c57c4860f714a3e42ecce52bf26b62e95bd28efd7580431674cc3052173f304d49122620e31a2227df3e327acf3cec34e042bdd0ce712c3392132dd2221ac85dea197766f82919bf8a925282b648499e2521fd93d3f492d49a26789205abfbcecc6b683cf7717bb36079ac88fcd2a12007470dc8f6146aa35b1bf747405026efd0869c8a455ba247b512e99465809b50cbdce96fdedba89f64cf66a4af5a951e389adf2784617c3b41d7a3be109f485b7fcf40dbe2ffaefa03c37b84b43d4f533d6f073cf7688d2be88145925f425d7dbbef9b750570389f491f017a6ce4b4188080b842097d85697eb8ffb403658866dab2f6bf8223b72d7ad327f3e186920e7442cd668aa9c0b4a559393c4aeea199aa8f697a3e8d8450cd3e52e0e13b735ce2a9f3a59d1fcd8763b8b6139285cc1216da0a9264132c070daee019847a5e789a198f9d875dc37930a77ba4a0fcb2015cf3bbe389eca5a8203d5dd5f5e35aa1dc125fbd768dd4b185ce7231083843f017a12e479f2910ef5b95c67b29940bf4545aeb8436d6d066cab9424323d414524464e2e083a0231465e625ab376f74a95aaf29a637afb24067332dcd4f354d8f1da9966c18be5a1a1130c33fdcde097e1380795d77b6ee8c7989e43cf54db1bc9f8f2bfe3bf071b9330e11d907321b0d44e51537eff476c76fbe2a7c009d8c293867ae41a1ca5a8b63c6ebec57476fd38dc9d6cb4eea318eff53a02d7244e3a635c7ed7555e9bc0e6e2b96e2379cc66415edc5ddca2f3a42447900a3b2da52e025c745a39ca7cf34158ccd2e1f48f283c9ce5126a32846aa9bd69a3d1925639b0f74fd93c54b6fe6bd5b4b947f9f92778da564a2f83dc0c4650559504168dca6845b0fc53db994598dc610997038859d023dd21151c150e02d8e1095a805d8ec47122bb9f5630a6279e88b745dec21fe7bbbcbdb19ad5fada6c868ebe3710da9db48330d9ada845c76dfd533693b0409ea75d68ddd8471ca93bdb9b0028dfe10c511596f71d26a49a870c1349d2c2d92333c096159de4826dc2c9277699292e6ea3e44e4038893eb96d662d9d695abc4b4179f22a31e059c530784fc7b9f92dfa2dea5c9cafde445427ae8545ac1a821053d04d4ede305a49fa3cde634851a7253b162cb5df2be735155f37d9866f2d360ee094f2112114dfd0530c093a7bfcd46b08de34a5a55c17db3da7bb3ab33e7ddcceb884d8600054ff687968311394cf6f72fa3208c9e9e02c7f64a8bb4b5cf5077f09ce50b40f81233d9a31f3c4a9c671cd046248dd85e9f0d97951ff67e62f5d6bfb317b8ec3b09f59d3c610fed8ee227af55c7bf557fdb049e5ecf3e12e9bc2b05a98b7f9c0a2af910dd6bbd3b1bbb18bd75b6fe63cd606a28d3541e72526bb0a59046423934f2eab3e508a18e6207262c9d017cf2be0d01c7c9e6ee4bfd8603e48c83c5d8fb2eb493a21f1424c96e5a73a7e10d3816dd263761da851db6601c2c1d70a98a6dcf26a7dd921c7e47a0313b30d55f9c38a2a18cc5284f825f5768e952cfc4ca2e318bd1f40b14803b3b0f2fab197b9d7514e8e18817f37b3d972d8bccdd8be945252dd14cc0a75169bfcb42416209946e30d6d8cf2349855f3accc4e9c26aced307037ba924de94eb86962b9d44a44f5674df61f8fc01c0146ac833836e7b286425293ab0ca83918de7f37a84fe77af9986558a0cdc03877b3456da97938883ba853454efc79be49744bbf043631fd919d04b829105e14a4d598d2a1f4707de815b810fd0e93cfac974976aab0340a4b32d7e6f11d12a9ffa2dd301363a611a997675edab4af4881745b9018f5708224fdaf3e7fced131e1f3f44e8512c52d7cbd486d649efd895e2c7c98badffeae322ee805b3509cfbeb183b992850f1d7668554528e657cb266c9d9c4cfcdb53b050f49455a889b6d94442ca31c2b91f07f07c99e56d27bad31e0c3ce746bab1c12bc00d723c1e78c86696b490202467be2411febd0d443dbbd9009d8812ec80de1038fa81141017a205d98fe54caf55f24c5bb5a00590abdf16c4e8ab8dedc43ca617ffa4fe5bfe6b6f5ac37bc80afe8cef801dec0d2e05408e6253fa0b24221686827b8ee0948d5b451f4558d54ea407eb5db9fea1dd508db15a29d35ead1f567d8ee3261fd7679ff0a03", 0x1000, 0x80, &(0x7f0000000200)={0x11, 0xe9, r6, 0x1, 0x1, 0x6, @multicast}, 0x14)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0)
ioctl$KVM_SET_FPU(r3, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0xd, 0x99, 0x0, 0x0, 0x10000, 0x2, '\x00', 0x8c94})
ioctl$KVM_RUN(r7, 0xae80, 0x0)

program crashed: WARNING in nsfs_fh_to_dentry
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <23>
bisect: split chunk #0 of len 23 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 30, 2, 20, 27, 3, 22, 9, 7, 6, 8, 4, 13, 4, 2, 24]
detailed listing:
executing program 2:
ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0x0, 0xa, 0x0, 0xa, 0xfc, 0x0, 0x0, 0xfc, 0xfe, 0x0, 0x1}, {0x5000, 0x8000000, 0x3, 0x1, 0x40, 0x3, 0x4, 0x9, 0x0, 0x0, 0x0, 0x42}, {0x3000, 0xeeef0000, 0x0, 0x8, 0x0, 0x80, 0xb, 0xf, 0x4, 0xe, 0x84, 0x3}, {0x100000, 0x0, 0x0, 0x0, 0x1, 0x3, 0xff}, {0x11000, 0xd000, 0xc, 0x0, 0x0, 0x80, 0x94, 0x0, 0x2, 0x0, 0x1a}, {0xd000, 0x8000000, 0xe, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x20, 0x0, 0x84, 0x2}, {0x8080000, 0x80a0000, 0x4, 0xf0, 0x0, 0xde, 0xfd, 0x6, 0x1, 0x0, 0x20}, {0x1, 0x10000, 0x4, 0xf9, 0x0, 0x70, 0x4, 0xc, 0x0, 0x2f, 0x20, 0x40}, {0x6000, 0x4fe8}, {0x8080000, 0xfffe}, 0x0, 0x0, 0xdddd1000, 0x0, 0xb, 0x0, 0x900, [0x5, 0x8, 0x0, 0x3fffffffffff]})
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = eventfd2(0x2, 0x0)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x7, 0x2, 0x2, r2, 0xb})
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x2, 0x5, 0x0, 0x4002004c5, 0x1000, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2], 0x8080000, 0x1144})
ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 6)
executing program 3:
r0 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000001c0)={0x0, 0x1, 0x5, 0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x4fceeeaa7ddace38, 0x0, '\x00', @string=&(0x7f0000000300)=0x4}})
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f00000009c0)="12", 0x1}], 0x1, 0x2, 0x1, 0x0)
r1 = socket(0x1d, 0x2, 0x6)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x10000)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
r3 = userfaultfd(0x80000)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000400)={{&(0x7f00007a7000/0x4000)=nil, 0x4000}, 0xb})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r4=>0x0})
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000180)=0xa, 0x4)
socket$unix(0x1, 0x5, 0x0)
r5 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', <r6=>0x0})
connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10)
sendmsg$can_bcm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0x20000600}, 0x1, 0x0, 0x0, 0x4000}, 0x4)
bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r4, 0x1, {0x0, 0x0, 0x3}, 0xff}, 0x18)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4801}, 0x20044810)
r7 = socket$phonet_pipe(0x23, 0x5, 0x2)
getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x9, 0x0, &(0x7f0000000740))
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$EXT4_IOC_SETFSUUID(r7, 0x4008662c, &(0x7f0000000140)={0x10, 0x0, "8e3c8b54b42cd92efdaa0e07f8e011f5"})
capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x10000000, 0x0, 0x4})
mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_NL_NET_SET(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a00)=ANY=[@ANYBLOB="f2142ab5f0af551396cd6bcf23c8ce4bcc416d49ef8a9bc27a991c0ce83ff73151518690d423b44669f9900fea920986f131a6a3fff094bb38961d72800fe414fdaac80772f6dfc6dc8103ceeb682dd4a64a1fd6aa0c69d9748367b027f98b6a4b46c1a3fae978a7c06e5a69a53e505d86ca3b9b1bf1fa731663d358f2b3f75f476764d3fee8b1caf630742c5c698e45425ff6902eb4e8369c1fd44a800eb37cc179a6f1a634c28a2920fdc9a48daf472c6b09275a7b1279a2b7fc38c1a5d3b8d5c61d3bc9220ec5a2648688905c7d1ec11824677aac6658dbc4e826e0ae2b1337b96d28e04f71fea9c699595870", @ANYBLOB="64e6afca3e05bfa47bf80a903e55365b71197c1bd24c42fdf0b37805cb0833e7a5bdf205f183fe02b67eb6b07397874a788b227590bd8f5c3583bad1ab54e85063b6740196e609ddf1511d0b5a57828bc79485b320548e7f3d81253d1034897c03b0ae21067cedf27d0240a65d1cf135e9cbce162f601d6514f703c9f1d64088d8b4ba89a24622d1502670e4232c43603c0f3fd43ecf7abe90fa1c2534d62a35fd7f626a93f34afe76a77a5a9fa0c4c9662f7de3f128ea", @ANYBLOB="010080000000fedbf3250f000000"], 0x14}, 0x1, 0x0, 0x0, 0x2805}, 0x0)
sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00cbf4fbfff3e1c4ee00020900010073797a310000000028000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000111f01f9a8122209a8bb5da1a4d9b4bd4c7adcc5604510e03a361ccc991a1e7197422d76fba5495a521b91387dc87aa06a034c974e3ef9f5b09b10335d927b03d782536a0f6663794676a0c940db7a70500f254eca4a49158f1c75d9c8b7f8d5d4891e248fcf683c72529a73f9758cea1a13bef6d74b226c13d3e0f057dd61a63db141c1827a812cee2006ba0ca0c2655918ea85842fb08dbe27fa411e0f95fcdd631605000000111ed4d03e7abe88ac687267b9e04764c95a68b83f33668f379ca6df17c8e42e29e7d94db1b2e87bfe7ff1339f122a27c30ad718ee0f3099d16d3dc25331e584715e01148cff91d980f5f631b974cb59d6f70b4469b88f66e754a0a949f69b031bcaedf0147651ffe5e5ccaa6896f3c55e335cbb332740945ca070391f75f8266f444f3444998a8e04b6db554679d2a3b7a3f75fca"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
pipe2(&(0x7f0000001cc0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@uname={'uname', 0x3d, '\xd0\xae\xde\xc1\xaa \xff\xd8\x1d\x1b\xf8\x93)!|\xb0X\xa3\x96\xed\xa2\xab@\xa2m\x93\xdd\b<\x00t\xdc\xabl\xab!\xae\x16\xc4\xcd\xf9{\xdc5_;A\xd2{eC\x014\\\xb3\xc4\xce\xc3yS2-\x01\xbe\xaarW\x96O\xd3\x0f\xe2\xd7/\x17\x1d\xa7.8\x9f8-\xea<\x8d\x91\x90j\xea\xd5\xd5\xae\xcc\xc0\x97\xef\x10\x92\xea\x98|+\x00\x00\x00\x00\x00\x00\x00\x00'}}]}})
executing program 3:
mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0)
r0 = syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x101440)
ioctl$EVIOCSCLOCKID(r0, 0x40084504, &(0x7f0000ffcffc)=0x2ff)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x19})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x5})
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x4, 0x22ed42)
ioctl$SNDRV_PCM_IOCTL_INFO(r3, 0x81204101, &(0x7f0000000280))
r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[<r5=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, <r6=>0x0})
ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000440)={r6, 0x0, 0x0, 0x0, 0x0, [], [0x7, 0x0, 0x0, 0x80], [0x2000000]})
ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000200)={r6})
close_range(r2, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
syz_usb_connect$uac1(0x0, 0xb1, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001", @ANYBLOB="8528c6"], 0x0)
close(r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0))
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58)
setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x2009)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xf, &(0x7f0000000040), 0x4}, 0x4000000)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0)
close(r2)
socket$kcm(0x10, 0x2, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8b32, &(0x7f0000000000)={'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}})
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b0f, &(0x7f0000000000)={'wlan1\x00'})
r3 = socket$kcm(0x2, 0x200000000000001, 0x0)
sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085)
sendmsg$inet(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f00000001c0)='{', 0x1}], 0x1}, 0x8000)
r4 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000180)={<r5=>0xffffffffffffffff})
sendmsg$inet(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000200)='R', 0x1}], 0x1}, 0x0)
sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)="b8", 0x1}], 0x1, 0x0, 0x0, 0x10000000}, 0x0)
syz_usb_connect(0x5, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0})
connect$phonet_pipe(0xffffffffffffffff, &(0x7f0000000200)={0x23, 0x20, 0x8, 0x9}, 0x10)
pipe(&(0x7f00000000c0)={<r6=>0xffffffffffffffff})
sendto$inet(r6, &(0x7f0000000140)="8ed4e1", 0x3, 0x8000000, &(0x7f0000000180)={0x2, 0x4e24, @broadcast}, 0x10)
r7 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, 0x0, 0x20040841)
ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000080)={&(0x7f00000001c0)=[{0x1, 0xb210, 0x0, 0x0}, {0x9, 0xa200, 0x0, 0x0}], 0x2})
setsockopt$kcm_KCM_RECV_DISABLE(r4, 0x119, 0x1, &(0x7f0000000240)=0x3ffc0000, 0x4)
executing program 2:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1)
sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)='%', 0x1}], 0x1}, 0x10000000)
executing program 2:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000080)=0x1, 0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r1=>0x0})
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = inotify_init1(0x800)
r6 = fcntl$dupfd(r4, 0x406, r5)
connect$pppl2tp(r6, &(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, r6, 0x2, 0x2, 0x4, 0x3, {0xa, 0x4e22, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2b9d}}}, 0x3a)
setsockopt$inet_mtu(r6, 0x111, 0xa, &(0x7f0000000000)=0x3, 0x4)
socket$packet(0x11, 0x3, 0x300)
bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {0x0, 0x1}}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0x0, 0x1}, 0x1}, 0x18)
sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180))
fdatasync(r7)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'vxcan1\x00', @remote})
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000202010400000000000000000a0000003c0002800c00028005000100000000002c0001"], 0x50}}, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8a, 0x61, 0x6a, 0x8, 0xc98, 0x1140, 0xf021, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x4e, 0x0, 0x0, 0x3, 0x9a, 0x3e, 0xc}}]}}]}}, 0x0)
executing program 0:
pipe2(&(0x7f0000001cc0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
r2 = socket$inet(0x2, 0x3, 0x4)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xbc, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x50, 0x11, [{@in=@loopback, @in=@private=0xa010100, @in=@private=0xa010100, @in=@rand_addr=0x64010100, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x2}]}, @encap={0x1c, 0x4, {0xfffffffffffffffe, 0x4e24, 0x4e23, @in6=@private1}}]}, 0xbc}}, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10)
sendmmsg$inet(r2, &(0x7f0000000600)=[{{&(0x7f0000000380)={0x2, 0x4e01, @local}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x20, 0x0, 0x7, {[@rr={0x7, 0xf, 0x4, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @broadcast]}]}}}], 0x20}}], 0x1, 0x46000)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="24776664f81b233b2d6e04aaa880fbe2702328831a98b79dac807af7bf0cb81de23215470959d6db2533ea32b6846b7ac25ce4bbb5ec7246a19f287521c7f852d6b82b141c2d609b2fcc17355cb63b6fc139b6b2badd7acbbd20fd1b69abc59b9c9f44856e2969d68493b2784ebfbad4d489cfb4ec7564bbe023c49956752bfe9df98aed0a53bebcb5", @ANYRESHEX=r1, @ANYBLOB="2c756e616d653dd0aedec1aa20ffd81d1bf89329217cb058a396eda2ab40a26d93dd083c0074dcab6cab21ae16c4cdf97bdc355f3b41d27b654301345cb3c4cec37953322d01beaa7257964fd30fe2d72f171da72e389f382dea3c8d91906aead5d5aeccc097ef1092ea987c2b00000000000000002c00"])
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e24, @multicast2}, 0x10)
sendmmsg$inet(r1, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10, 0x0}}], 0x1, 0x2000c000)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x25, &(0x7f0000000140)=@gcm_128={{0xcf05a145b37f58f3}, "2034b251822b3a46", "fa6b72def4acb1a6c86918c638857983", "34b3adec", "6745ac421772258f"}, 0x28)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1)
sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)='%', 0x1}], 0x1}, 0x10000000)
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0x19, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x7, r1, 0x0, &(0x7f0000ff0000/0x10000)=nil, 0x10000})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r1, 0x0, <r2=>0xffffffffffffffff})
ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x8, r2, 0x0, 0x0, 0xffca, &(0x7f0000000040)='?', 0x5})
executing program 0:
r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x2, 0xe})
ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f00000000c0)={0x2})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0)
ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000080))
r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x300c0, 0x46)
open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x0)
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002040)=""/4096, 0x1000}], 0x0, 0x0, 0xfffffe2a}}, {{0x0, 0x0, 0x0}}], 0x400000000000059, 0x2040, 0x0) (fail_nth: 10)
executing program 2:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0xc00, 0x56, 0x9, 0x800000}, {0x7c5, 0xff, 0x0, 0x9}, {0x7, 0x93, 0x10, 0x2}]})
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x5, 0x10000000}}, 0x400040)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x12, r2, 0x0)
ioctl$SG_BLKTRACESTOP(r2, 0x1275, 0x0)
r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x80044941, 0x0)
ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140))
ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000040)={0x5, <r4=>r1, 0x2})
ioctl$EVIOCGLED(r4, 0x80404519, &(0x7f0000000200)=""/98)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = socket(0xa, 0x5, 0x0)
setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x83, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 3:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000001440)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0xa}})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
listen(r2, 0x1000)
getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000000000000458000b480400945f64009400050038925a01000000000000008004000000ff", 0x3d}], 0x1)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
r4 = socket$packet(0x11, 0x2, 0x300)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'gre0\x00', <r6=>0x0})
setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4)
sendto$packet(r5, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @multicast}, 0x14)
sendto$packet(r4, &(0x7f0000000440)="1df1b43c99c11d021b4b0233302df5d3e3babdd02abc52a1bb65d50484e516f8529c11c7b7eadd4c66ed54a772fae6ee6b60db7043b3cff3d1080f9494b06cd3b2425cd96acad4ed347f6619f1c14c71fdc7035b5b9e554eac80a6b66cc5bdcdfefd6c796ec9327e5f905647405a6d9bcdc81e6a03861838e2483acacaaf74be0fc33fba2935ebf00066a6f98dac5876c7ec2e6d74419a5b4febb3f30a3c9ab2520613ad3796ddb020f23d54d8b3037031242757d39ea9dc9e287393b6fc990693c52332970e12b4a7e26d2377932a52cb1ff09c69fa1e1d249d78376ee97816a31d834fa2c5a8b432bdce6e5576ad7f0dff33a2c7513e18d930cb5afc6ae2ee9ea0b9711af65353e39092a1c748ea73ad4f5df985fa24a3af6577f283662c633f20e0de1987a31773db91a7986a6db630ec2ebe1623d2287d883e6d76eafb04efb0bed270230e8f6463e60f6967720af2e43209d777636de33548e7c7c7b3fd93d0e990bc350652cc677691901dfcf5e7dc99e5e3cabda41b8bacd9fa8404decc31c3908e42908d92b6d947ff329866face99b4daa8e524c9d909b0de54038a54852d9ccd4f1b8a3d86957f222621dbf76074291517dba8d4e4bce89f42dea6c63fdc638e7a57cdaff25cc4acb30e02ddc96b25195da544ce508f3d47a024a6dc301f888caeb2da391bf6c7e6a4bc84bf57aaaadf8a2905cebb447f183c61bc6efb9eefb36148db88971012f0c77c9ba4e9c198077a6a78f18b88ea80f043b730f5be95245a7308d72f793df349e403641f8509f47950f538ddd9f803f9e5d9ccb8021f6d478195f94cafb4280762d55012caa3d17ee5fb53fc7ddfac2c6d90fca621cccbf47a7eb9e5697814bd9a97b850a0144d0fd7c1b7a26cfa76a7154e92f9a450cfc11624926f321fd3e172703fa7a106445d356195a14a6df76c054ba956a8037fae9519a330f2fa712bc5005157e0893a229dc80ae43c0144dff420d863dae3f347953b382b2bfc430dddac6fe5a9dfeaa6b23a16e9bc267421721dc61c83945a054ea6ab744a1ceaa017eb920a9e93c9260902c6ec0f010381570e8ad204e241bd3a4af70b101d331bac92e19653718d5c3de603fb2ac60f89cd1060c71b58a61a2e115a5faf007eaa430ed62191278f427798a55067e8276b608820e76e28ce9d2d83b3064b2e6fb079f3d9005aca71ac605bc6c4a7ac1f0af600760a83e49924d2c98be59d4528979f1bdf5a9fa6c7ef9829e431d8eddf4021dab7982fb99cf0264a9d49490464e45d453bc0b8ba73a1ea94add1dca90acee66220fd7a112952ed9ac57cb1b4d46a76f72fdb607f7be21c794fec17bac1252959d03be89dbf41756a308075cd1e41d5dbfd7148beaeb1ecb1c6e504258147eba9dd327537217a3445f0f030bc590d886dec5fd15d3d4029177fb4242970ed2a6b70c0a76be3e5b047895b6c3227255c4e6ffffc1afa1c650f2eb4f3af5f11c273d1bdf9e1ece42aecd85fc0d67a1e8baad9ccec35b64c5ffc62e99cf7a0a2501f3ff5aa1dd6421cb1b39c174d8ce3ef1fdfcb924eb2f8a2fb3ef886646ad06de7ef77ef0e2bb987e8f2d6d797739ba69aea37a28b5f039dc45414d01d366b4ed0109eefc3013af76f585e6ecc36c34386f93ca12432ece65e2876414cfd4abd2afe3ee02502f537e3e15c8605b06da33674eba04b900f4d4197435c5ee042fa739e51a72b73f561d65eb9642c785bbce1a9715035ac96022c0c9c7bec74349067d4a2c2187fc5d57f20f905d807f3b72b517f38ba9557dccae63b5d28285e5831c49463500cd359cc4872ae965536ee7cc25049e18e80adbb2bc55db1121b4635b24ae3ef6290579e3a59b136bc3cbe31587b9de4889f1e41d6958634f7ec3c51c75d60473a04f20a70ac068797b78ee32add897444df44e39ec39e1bcee3f27af2e4aed30bed439a064e15b98017634e7d42e97d6b69a08be31d9de72041ac0761068f49a68d14f72304144ec8797a24f2a2c67f0679d29dbfc0469637964c646e676470c1606f9a6573a5b0fd763d972b590851d16250fda88808a50fa66d1a41f8d0397063d8d926348884f57f5ddacd3ef86f1a0b1e450737a6446c9935747ad92aec26d2e1a07655a0dfd0d27acc288c5c35b9695a8250fda210a6ed56d828cb91620d83f2a14698ef32929f56880c2414de32294ca9b8602c6fbc7e8fbfb7aaee092303eade3ca1937cf3e7f744a6fa0892a04f411e843f7f327ea8e69c63ceb2be5ebce40f310751df41805928b198bb9e87631c72be95d67774c123fea3d1496d59f527cd3f0af5c5402a31617aefffa8f071fc714efafd75cb428a340c7724d562965679eba3f41705aceb86d34e3b4595058a76e1c0fbb5f11899ba1a9cc09cc1232b863ad70dd37a27b62b3000b61769645cae92ebd710816a5d2d0e1b67340b594a43d3801f7c41b6415851e3832f3d0d272deef652bef044506e78bc01f9a9127b77a37603dd08af1f2eb11cfd5dd90d310917b8a29e2a8efd780b09b25e2bf04d3bdfd702527d4a24cac4c91722715ac489e4a3f6cf758c12f5d9b44f87d394ffab621d8ca5cb795f393008e09a9f2630f77ab78d07b0844fcbe66813885776cf62178917862636d3381c9c8848163b86cb4a8f2f7a3e9ab11ebd14e8c771e13064e46c2c2bad633ee64fedb3d8ed07b053939cbc07e1875fe4ac5edf6139470f36caff31bab28974e2b0a95bad7580d72c0e71d8ec0441feb3e33495754a880ffb23e747926d7ffcc398a410057c0606c949d8f2dbb66ca2a910ded4c104acfe62fca8a55727e4b9db6ff798d39eabe52d61706740bdedbda35ee12c29bd51054b3102451a386b6942113f3c07737cb03b37e90c3a7454148d96168cbfbe49a7977dbc689f14682528d1135b84c07cedf5c3e77c12f9eb6565c2950288854a34ebbe6d28ec4fd267e033d1236a93f2d906e20862f83e00eeda125bf4066d81c6a74d1a975eda2a517858429eccf2b2f9205fb99abe737c0ffc04adfe95cb09dccd6339c1c1199523bd42d1f31bf0be8ae9c511dce9a93d22f5913df6d6dcd8e5ecf42719afefd8cb06deb4f080b17a6694754932af639926d8b06268ba695990093360511a6c5e6aaf4b9ed21cd966face90f95fbc54907e9f95e21169faa4d445d43f9e3306e8ce1c980f87c433001d4d5dfa1e709ab119c55293cdfa69f525d0d155886deca97490f19927c22e47c8e60b2cb83732d12583dfd2dcfd2a9e02ea1245bc86622a80448e4c2df6231af73a8255ccea0a72953344394866dd0bc0c175e264bec83b43b64945c54095ad7722e2102b19309f41df9d35cbcd7d0e6a7d7ce5e56aa85e2f9ff610b8ce139f8add5fefb8c1ecd7a35c810aa1c9bd3fedd8f7620c17099846d4c51ccf6ff09093c1715909364e2c8afc729259c7aff069ed0751b6a862097652fe71d896fc0dd05fa4822ec9343fa4b16ff23d48f680dc7d1e8dd058e636d1427439ab7ef5f024da9863da8fb41d7c27c4346644fe0acbdf3abd240d1f9277cd8d49baff71abf768e190477fbb66cc7a7b7871c00c4337e84d8eb5d0fa0f93c96eae41427b40223341aa428cafea5c57c4860f714a3e42ecce52bf26b62e95bd28efd7580431674cc3052173f304d49122620e31a2227df3e327acf3cec34e042bdd0ce712c3392132dd2221ac85dea197766f82919bf8a925282b648499e2521fd93d3f492d49a26789205abfbcecc6b683cf7717bb36079ac88fcd2a12007470dc8f6146aa35b1bf747405026efd0869c8a455ba247b512e99465809b50cbdce96fdedba89f64cf66a4af5a951e389adf2784617c3b41d7a3be109f485b7fcf40dbe2ffaefa03c37b84b43d4f533d6f073cf7688d2be88145925f425d7dbbef9b750570389f491f017a6ce4b4188080b842097d85697eb8ffb403658866dab2f6bf8223b72d7ad327f3e186920e7442cd668aa9c0b4a559393c4aeea199aa8f697a3e8d8450cd3e52e0e13b735ce2a9f3a59d1fcd8763b8b6139285cc1216da0a9264132c070daee019847a5e789a198f9d875dc37930a77ba4a0fcb2015cf3bbe389eca5a8203d5dd5f5e35aa1dc125fbd768dd4b185ce7231083843f017a12e479f2910ef5b95c67b29940bf4545aeb8436d6d066cab9424323d414524464e2e083a0231465e625ab376f74a95aaf29a637afb24067332dcd4f354d8f1da9966c18be5a1a1130c33fdcde097e1380795d77b6ee8c7989e43cf54db1bc9f8f2bfe3bf071b9330e11d907321b0d44e51537eff476c76fbe2a7c009d8c293867ae41a1ca5a8b63c6ebec57476fd38dc9d6cb4eea318eff53a02d7244e3a635c7ed7555e9bc0e6e2b96e2379cc66415edc5ddca2f3a42447900a3b2da52e025c745a39ca7cf34158ccd2e1f48f283c9ce5126a32846aa9bd69a3d1925639b0f74fd93c54b6fe6bd5b4b947f9f92778da564a2f83dc0c4650559504168dca6845b0fc53db994598dc610997038859d023dd21151c150e02d8e1095a805d8ec47122bb9f5630a6279e88b745dec21fe7bbbcbdb19ad5fada6c868ebe3710da9db48330d9ada845c76dfd533693b0409ea75d68ddd8471ca93bdb9b0028dfe10c511596f71d26a49a870c1349d2c2d92333c096159de4826dc2c9277699292e6ea3e44e4038893eb96d662d9d695abc4b4179f22a31e059c530784fc7b9f92dfa2dea5c9cafde445427ae8545ac1a821053d04d4ede305a49fa3cde634851a7253b162cb5df2be735155f37d9866f2d360ee094f2112114dfd0530c093a7bfcd46b08de34a5a55c17db3da7bb3ab33e7ddcceb884d8600054ff687968311394cf6f72fa3208c9e9e02c7f64a8bb4b5cf5077f09ce50b40f81233d9a31f3c4a9c671cd046248dd85e9f0d97951ff67e62f5d6bfb317b8ec3b09f59d3c610fed8ee227af55c7bf557fdb049e5ecf3e12e9bc2b05a98b7f9c0a2af910dd6bbd3b1bbb18bd75b6fe63cd606a28d3541e72526bb0a59046423934f2eab3e508a18e6207262c9d017cf2be0d01c7c9e6ee4bfd8603e48c83c5d8fb2eb493a21f1424c96e5a73a7e10d3816dd263761da851db6601c2c1d70a98a6dcf26a7dd921c7e47a0313b30d55f9c38a2a18cc5284f825f5768e952cfc4ca2e318bd1f40b14803b3b0f2fab197b9d7514e8e18817f37b3d972d8bccdd8be945252dd14cc0a75169bfcb42416209946e30d6d8cf2349855f3accc4e9c26aced307037ba924de94eb86962b9d44a44f5674df61f8fc01c0146ac833836e7b286425293ab0ca83918de7f37a84fe77af9986558a0cdc03877b3456da97938883ba853454efc79be49744bbf043631fd919d04b829105e14a4d598d2a1f4707de815b810fd0e93cfac974976aab0340a4b32d7e6f11d12a9ffa2dd301363a611a997675edab4af4881745b9018f5708224fdaf3e7fced131e1f3f44e8512c52d7cbd486d649efd895e2c7c98badffeae322ee805b3509cfbeb183b992850f1d7668554528e657cb266c9d9c4cfcdb53b050f49455a889b6d94442ca31c2b91f07f07c99e56d27bad31e0c3ce746bab1c12bc00d723c1e78c86696b490202467be2411febd0d443dbbd9009d8812ec80de1038fa81141017a205d98fe54caf55f24c5bb5a00590abdf16c4e8ab8dedc43ca617ffa4fe5bfe6b6f5ac37bc80afe8cef801dec0d2e05408e6253fa0b24221686827b8ee0948d5b451f4558d54ea407eb5db9fea1dd508db15a29d35ead1f567d8ee3261fd7679ff0a03", 0x1000, 0x80, &(0x7f0000000200)={0x11, 0xe9, r6, 0x1, 0x1, 0x6, @multicast}, 0x14)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0)
ioctl$KVM_SET_FPU(r3, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0xd, 0x99, 0x0, 0x0, 0x10000, 0x2, '\x00', 0x8c94})
ioctl$KVM_RUN(r7, 0xae80, 0x0)

program crashed: WARNING in nsfs_fh_to_dentry
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 6, 8, 4, 13, 4, 2, 24]
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e24, @multicast2}, 0x10)
sendmmsg$inet(r1, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10, 0x0}}], 0x1, 0x2000c000)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x25, &(0x7f0000000140)=@gcm_128={{0xcf05a145b37f58f3}, "2034b251822b3a46", "fa6b72def4acb1a6c86918c638857983", "34b3adec", "6745ac421772258f"}, 0x28)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1)
sendmsg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)='%', 0x1}], 0x1}, 0x10000000)
executing program 0:
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0x19, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x7, r1, 0x0, &(0x7f0000ff0000/0x10000)=nil, 0x10000})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r1, 0x0, <r2=>0xffffffffffffffff})
ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x8, r2, 0x0, 0x0, 0xffca, &(0x7f0000000040)='?', 0x5})
executing program 0:
r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x2, 0xe})
ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f00000000c0)={0x2})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0)
ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000080))
r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x300c0, 0x46)
open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x0)
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0)
sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0)
recvmmsg(r0, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002040)=""/4096, 0x1000}], 0x0, 0x0, 0xfffffe2a}}, {{0x0, 0x0, 0x0}}], 0x400000000000059, 0x2040, 0x0) (fail_nth: 10)
executing program 2:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0xc00, 0x56, 0x9, 0x800000}, {0x7c5, 0xff, 0x0, 0x9}, {0x7, 0x93, 0x10, 0x2}]})
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x5, 0x10000000}}, 0x400040)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x12, r2, 0x0)
ioctl$SG_BLKTRACESTOP(r2, 0x1275, 0x0)
r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x80044941, 0x0)
ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140))
ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000040)={0x5, <r4=>r1, 0x2})
ioctl$EVIOCGLED(r4, 0x80404519, &(0x7f0000000200)=""/98)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = socket(0xa, 0x5, 0x0)
setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x83, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
executing program 3:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000001440)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0xa}})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
listen(r2, 0x1000)
getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000000000000458000b480400945f64009400050038925a01000000000000008004000000ff", 0x3d}], 0x1)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
r4 = socket$packet(0x11, 0x2, 0x300)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'gre0\x00', <r6=>0x0})
setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4)
sendto$packet(r5, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @multicast}, 0x14)
sendto$packet(r4, &(0x7f0000000440)="1df1b43c99c11d021b4b0233302df5d3e3babdd02abc52a1bb65d50484e516f8529c11c7b7eadd4c66ed54a772fae6ee6b60db7043b3cff3d1080f9494b06cd3b2425cd96acad4ed347f6619f1c14c71fdc7035b5b9e554eac80a6b66cc5bdcdfefd6c796ec9327e5f905647405a6d9bcdc81e6a03861838e2483acacaaf74be0fc33fba2935ebf00066a6f98dac5876c7ec2e6d74419a5b4febb3f30a3c9ab2520613ad3796ddb020f23d54d8b3037031242757d39ea9dc9e287393b6fc990693c52332970e12b4a7e26d2377932a52cb1ff09c69fa1e1d249d78376ee97816a31d834fa2c5a8b432bdce6e5576ad7f0dff33a2c7513e18d930cb5afc6ae2ee9ea0b9711af65353e39092a1c748ea73ad4f5df985fa24a3af6577f283662c633f20e0de1987a31773db91a7986a6db630ec2ebe1623d2287d883e6d76eafb04efb0bed270230e8f6463e60f6967720af2e43209d777636de33548e7c7c7b3fd93d0e990bc350652cc677691901dfcf5e7dc99e5e3cabda41b8bacd9fa8404decc31c3908e42908d92b6d947ff329866face99b4daa8e524c9d909b0de54038a54852d9ccd4f1b8a3d86957f222621dbf76074291517dba8d4e4bce89f42dea6c63fdc638e7a57cdaff25cc4acb30e02ddc96b25195da544ce508f3d47a024a6dc301f888caeb2da391bf6c7e6a4bc84bf57aaaadf8a2905cebb447f183c61bc6efb9eefb36148db88971012f0c77c9ba4e9c198077a6a78f18b88ea80f043b730f5be95245a7308d72f793df349e403641f8509f47950f538ddd9f803f9e5d9ccb8021f6d478195f94cafb4280762d55012caa3d17ee5fb53fc7ddfac2c6d90fca621cccbf47a7eb9e5697814bd9a97b850a0144d0fd7c1b7a26cfa76a7154e92f9a450cfc11624926f321fd3e172703fa7a106445d356195a14a6df76c054ba956a8037fae9519a330f2fa712bc5005157e0893a229dc80ae43c0144dff420d863dae3f347953b382b2bfc430dddac6fe5a9dfeaa6b23a16e9bc267421721dc61c83945a054ea6ab744a1ceaa017eb920a9e93c9260902c6ec0f010381570e8ad204e241bd3a4af70b101d331bac92e19653718d5c3de603fb2ac60f89cd1060c71b58a61a2e115a5faf007eaa430ed62191278f427798a55067e8276b608820e76e28ce9d2d83b3064b2e6fb079f3d9005aca71ac605bc6c4a7ac1f0af600760a83e49924d2c98be59d4528979f1bdf5a9fa6c7ef9829e431d8eddf4021dab7982fb99cf0264a9d49490464e45d453bc0b8ba73a1ea94add1dca90acee66220fd7a112952ed9ac57cb1b4d46a76f72fdb607f7be21c794fec17bac1252959d03be89dbf41756a308075cd1e41d5dbfd7148beaeb1ecb1c6e504258147eba9dd327537217a3445f0f030bc590d886dec5fd15d3d4029177fb4242970ed2a6b70c0a76be3e5b047895b6c3227255c4e6ffffc1afa1c650f2eb4f3af5f11c273d1bdf9e1ece42aecd85fc0d67a1e8baad9ccec35b64c5ffc62e99cf7a0a2501f3ff5aa1dd6421cb1b39c174d8ce3ef1fdfcb924eb2f8a2fb3ef886646ad06de7ef77ef0e2bb987e8f2d6d797739ba69aea37a28b5f039dc45414d01d366b4ed0109eefc3013af76f585e6ecc36c34386f93ca12432ece65e2876414cfd4abd2afe3ee02502f537e3e15c8605b06da33674eba04b900f4d4197435c5ee042fa739e51a72b73f561d65eb9642c785bbce1a9715035ac96022c0c9c7bec74349067d4a2c2187fc5d57f20f905d807f3b72b517f38ba9557dccae63b5d28285e5831c49463500cd359cc4872ae965536ee7cc25049e18e80adbb2bc55db1121b4635b24ae3ef6290579e3a59b136bc3cbe31587b9de4889f1e41d6958634f7ec3c51c75d60473a04f20a70ac068797b78ee32add897444df44e39ec39e1bcee3f27af2e4aed30bed439a064e15b98017634e7d42e97d6b69a08be31d9de72041ac0761068f49a68d14f72304144ec8797a24f2a2c67f0679d29dbfc0469637964c646e676470c1606f9a6573a5b0fd763d972b590851d16250fda88808a50fa66d1a41f8d0397063d8d926348884f57f5ddacd3ef86f1a0b1e450737a6446c9935747ad92aec26d2e1a07655a0dfd0d27acc288c5c35b9695a8250fda210a6ed56d828cb91620d83f2a14698ef32929f56880c2414de32294ca9b8602c6fbc7e8fbfb7aaee092303eade3ca1937cf3e7f744a6fa0892a04f411e843f7f327ea8e69c63ceb2be5ebce40f310751df41805928b198bb9e87631c72be95d67774c123fea3d1496d59f527cd3f0af5c5402a31617aefffa8f071fc714efafd75cb428a340c7724d562965679eba3f41705aceb86d34e3b4595058a76e1c0fbb5f11899ba1a9cc09cc1232b863ad70dd37a27b62b3000b61769645cae92ebd710816a5d2d0e1b67340b594a43d3801f7c41b6415851e3832f3d0d272deef652bef044506e78bc01f9a9127b77a37603dd08af1f2eb11cfd5dd90d310917b8a29e2a8efd780b09b25e2bf04d3bdfd702527d4a24cac4c91722715ac489e4a3f6cf758c12f5d9b44f87d394ffab621d8ca5cb795f393008e09a9f2630f77ab78d07b0844fcbe66813885776cf62178917862636d3381c9c8848163b86cb4a8f2f7a3e9ab11ebd14e8c771e13064e46c2c2bad633ee64fedb3d8ed07b053939cbc07e1875fe4ac5edf6139470f36caff31bab28974e2b0a95bad7580d72c0e71d8ec0441feb3e33495754a880ffb23e747926d7ffcc398a410057c0606c949d8f2dbb66ca2a910ded4c104acfe62fca8a55727e4b9db6ff798d39eabe52d61706740bdedbda35ee12c29bd51054b3102451a386b6942113f3c07737cb03b37e90c3a7454148d96168cbfbe49a7977dbc689f14682528d1135b84c07cedf5c3e77c12f9eb6565c2950288854a34ebbe6d28ec4fd267e033d1236a93f2d906e20862f83e00eeda125bf4066d81c6a74d1a975eda2a517858429eccf2b2f9205fb99abe737c0ffc04adfe95cb09dccd6339c1c1199523bd42d1f31bf0be8ae9c511dce9a93d22f5913df6d6dcd8e5ecf42719afefd8cb06deb4f080b17a6694754932af639926d8b06268ba695990093360511a6c5e6aaf4b9ed21cd966face90f95fbc54907e9f95e21169faa4d445d43f9e3306e8ce1c980f87c433001d4d5dfa1e709ab119c55293cdfa69f525d0d155886deca97490f19927c22e47c8e60b2cb83732d12583dfd2dcfd2a9e02ea1245bc86622a80448e4c2df6231af73a8255ccea0a72953344394866dd0bc0c175e264bec83b43b64945c54095ad7722e2102b19309f41df9d35cbcd7d0e6a7d7ce5e56aa85e2f9ff610b8ce139f8add5fefb8c1ecd7a35c810aa1c9bd3fedd8f7620c17099846d4c51ccf6ff09093c1715909364e2c8afc729259c7aff069ed0751b6a862097652fe71d896fc0dd05fa4822ec9343fa4b16ff23d48f680dc7d1e8dd058e636d1427439ab7ef5f024da9863da8fb41d7c27c4346644fe0acbdf3abd240d1f9277cd8d49baff71abf768e190477fbb66cc7a7b7871c00c4337e84d8eb5d0fa0f93c96eae41427b40223341aa428cafea5c57c4860f714a3e42ecce52bf26b62e95bd28efd7580431674cc3052173f304d49122620e31a2227df3e327acf3cec34e042bdd0ce712c3392132dd2221ac85dea197766f82919bf8a925282b648499e2521fd93d3f492d49a26789205abfbcecc6b683cf7717bb36079ac88fcd2a12007470dc8f6146aa35b1bf747405026efd0869c8a455ba247b512e99465809b50cbdce96fdedba89f64cf66a4af5a951e389adf2784617c3b41d7a3be109f485b7fcf40dbe2ffaefa03c37b84b43d4f533d6f073cf7688d2be88145925f425d7dbbef9b750570389f491f017a6ce4b4188080b842097d85697eb8ffb403658866dab2f6bf8223b72d7ad327f3e186920e7442cd668aa9c0b4a559393c4aeea199aa8f697a3e8d8450cd3e52e0e13b735ce2a9f3a59d1fcd8763b8b6139285cc1216da0a9264132c070daee019847a5e789a198f9d875dc37930a77ba4a0fcb2015cf3bbe389eca5a8203d5dd5f5e35aa1dc125fbd768dd4b185ce7231083843f017a12e479f2910ef5b95c67b29940bf4545aeb8436d6d066cab9424323d414524464e2e083a0231465e625ab376f74a95aaf29a637afb24067332dcd4f354d8f1da9966c18be5a1a1130c33fdcde097e1380795d77b6ee8c7989e43cf54db1bc9f8f2bfe3bf071b9330e11d907321b0d44e51537eff476c76fbe2a7c009d8c293867ae41a1ca5a8b63c6ebec57476fd38dc9d6cb4eea318eff53a02d7244e3a635c7ed7555e9bc0e6e2b96e2379cc66415edc5ddca2f3a42447900a3b2da52e025c745a39ca7cf34158ccd2e1f48f283c9ce5126a32846aa9bd69a3d1925639b0f74fd93c54b6fe6bd5b4b947f9f92778da564a2f83dc0c4650559504168dca6845b0fc53db994598dc610997038859d023dd21151c150e02d8e1095a805d8ec47122bb9f5630a6279e88b745dec21fe7bbbcbdb19ad5fada6c868ebe3710da9db48330d9ada845c76dfd533693b0409ea75d68ddd8471ca93bdb9b0028dfe10c511596f71d26a49a870c1349d2c2d92333c096159de4826dc2c9277699292e6ea3e44e4038893eb96d662d9d695abc4b4179f22a31e059c530784fc7b9f92dfa2dea5c9cafde445427ae8545ac1a821053d04d4ede305a49fa3cde634851a7253b162cb5df2be735155f37d9866f2d360ee094f2112114dfd0530c093a7bfcd46b08de34a5a55c17db3da7bb3ab33e7ddcceb884d8600054ff687968311394cf6f72fa3208c9e9e02c7f64a8bb4b5cf5077f09ce50b40f81233d9a31f3c4a9c671cd046248dd85e9f0d97951ff67e62f5d6bfb317b8ec3b09f59d3c610fed8ee227af55c7bf557fdb049e5ecf3e12e9bc2b05a98b7f9c0a2af910dd6bbd3b1bbb18bd75b6fe63cd606a28d3541e72526bb0a59046423934f2eab3e508a18e6207262c9d017cf2be0d01c7c9e6ee4bfd8603e48c83c5d8fb2eb493a21f1424c96e5a73a7e10d3816dd263761da851db6601c2c1d70a98a6dcf26a7dd921c7e47a0313b30d55f9c38a2a18cc5284f825f5768e952cfc4ca2e318bd1f40b14803b3b0f2fab197b9d7514e8e18817f37b3d972d8bccdd8be945252dd14cc0a75169bfcb42416209946e30d6d8cf2349855f3accc4e9c26aced307037ba924de94eb86962b9d44a44f5674df61f8fc01c0146ac833836e7b286425293ab0ca83918de7f37a84fe77af9986558a0cdc03877b3456da97938883ba853454efc79be49744bbf043631fd919d04b829105e14a4d598d2a1f4707de815b810fd0e93cfac974976aab0340a4b32d7e6f11d12a9ffa2dd301363a611a997675edab4af4881745b9018f5708224fdaf3e7fced131e1f3f44e8512c52d7cbd486d649efd895e2c7c98badffeae322ee805b3509cfbeb183b992850f1d7668554528e657cb266c9d9c4cfcdb53b050f49455a889b6d94442ca31c2b91f07f07c99e56d27bad31e0c3ce746bab1c12bc00d723c1e78c86696b490202467be2411febd0d443dbbd9009d8812ec80de1038fa81141017a205d98fe54caf55f24c5bb5a00590abdf16c4e8ab8dedc43ca617ffa4fe5bfe6b6f5ac37bc80afe8cef801dec0d2e05408e6253fa0b24221686827b8ee0948d5b451f4558d54ea407eb5db9fea1dd508db15a29d35ead1f567d8ee3261fd7679ff0a03", 0x1000, 0x80, &(0x7f0000000200)={0x11, 0xe9, r6, 0x1, 0x1, 0x6, @multicast}, 0x14)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0)
ioctl$KVM_SET_FPU(r3, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0xd, 0x99, 0x0, 0x0, 0x10000, 0x2, '\x00', 0x8c94})
ioctl$KVM_RUN(r7, 0xae80, 0x0)

program crashed: WARNING in nsfs_fh_to_dentry
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 3:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program crashed: WARNING in nsfs_fh_to_dentry
bisect: the chunk can be dropped
bisect: 1 programs left: 

executing program 3:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program crashed: WARNING in nsfs_fh_to_dentry
bisect: concatenation succeeded
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns
detailed listing:
executing program 0:
syz_open_procfs$userns(0x0, &(0x7f00000001c0))

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): open_by_handle_at
detailed listing:
executing program 0:
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, 0x0)
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, 0x0, 0x400040)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
program crashed: WARNING in nsfs_fh_to_dentry
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program crashed: WARNING in nsfs_fh_to_dentry
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program crashed: WARNING in nsfs_fh_to_dentry
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$userns-open_by_handle_at
detailed listing:
executing program 0:
r0 = syz_open_procfs$userns(0x0, &(0x7f00000001c0))
open_by_handle_at(r0, &(0x7f0000000000)=@ceph_nfs_confh={0x10, 0xf1, {0x1002, 0x10000000}}, 0x400040)

program crashed: WARNING in nsfs_fh_to_dentry
validation run: crashed=true
reproducing took 35m42.542795151s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: fs/nsfs.c:493 at nsfs_fh_to_dentry+0xcc5/0xdc0 fs/nsfs.c:493, CPU#1: syz.0.17/6050
Modules linked in:
CPU: 1 UID: 0 PID: 6050 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:nsfs_fh_to_dentry+0xcc5/0xdc0 fs/nsfs.c:493
Code: 7c 24 60 e9 10 f8 ff ff e8 48 01 79 ff 90 0f 0b 90 e9 09 f6 ff ff e8 3a 01 79 ff 90 0f 0b 90 e9 81 f6 ff ff e8 2c 01 79 ff 90 <0f> 0b 90 e9 d0 f6 ff ff e8 1e 01 79 ff 45 31 ff e9 d9 f7 ff ff e8
RSP: 0018:ffffc90002f97a20 EFLAGS: 00010293
RAX: ffffffff824717f4 RBX: 00000000effffffd RCX: ffff888031990000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000effffffd
RBP: ffffc90002f97b10 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e
R10: dffffc0000000000 R11: fffffbfff1fc9b6f R12: 1ffff920005f2f4c
R13: ffff888028d74894 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000555569cd2500(0000) GS:ffff8881258a2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32363fff CR3: 0000000028a1e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 exportfs_decode_fh_raw+0x178/0x6e0 fs/exportfs/expfs.c:456
 do_handle_to_path+0xa4/0x1a0 fs/fhandle.c:276
 handle_to_path fs/fhandle.c:400 [inline]
 do_handle_open+0x6b4/0x8f0 fs/fhandle.c:415
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a5d78ec29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff390c9e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000130
RAX: ffffffffffffffda RBX: 00007f1a5d9d5fa0 RCX: 00007f1a5d78ec29
RDX: 0000000000400040 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007f1a5d811e41 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a5d9d5fa0 R14: 00007f1a5d9d5fa0 R15: 0000000000000003
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: fs/nsfs.c:493 at nsfs_fh_to_dentry+0xcc5/0xdc0 fs/nsfs.c:493, CPU#1: syz.0.17/6050
Modules linked in:
CPU: 1 UID: 0 PID: 6050 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:nsfs_fh_to_dentry+0xcc5/0xdc0 fs/nsfs.c:493
Code: 7c 24 60 e9 10 f8 ff ff e8 48 01 79 ff 90 0f 0b 90 e9 09 f6 ff ff e8 3a 01 79 ff 90 0f 0b 90 e9 81 f6 ff ff e8 2c 01 79 ff 90 <0f> 0b 90 e9 d0 f6 ff ff e8 1e 01 79 ff 45 31 ff e9 d9 f7 ff ff e8
RSP: 0018:ffffc90002f97a20 EFLAGS: 00010293
RAX: ffffffff824717f4 RBX: 00000000effffffd RCX: ffff888031990000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000effffffd
RBP: ffffc90002f97b10 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e
R10: dffffc0000000000 R11: fffffbfff1fc9b6f R12: 1ffff920005f2f4c
R13: ffff888028d74894 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000555569cd2500(0000) GS:ffff8881258a2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32363fff CR3: 0000000028a1e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 exportfs_decode_fh_raw+0x178/0x6e0 fs/exportfs/expfs.c:456
 do_handle_to_path+0xa4/0x1a0 fs/fhandle.c:276
 handle_to_path fs/fhandle.c:400 [inline]
 do_handle_open+0x6b4/0x8f0 fs/fhandle.c:415
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a5d78ec29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff390c9e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000130
RAX: ffffffffffffffda RBX: 00007f1a5d9d5fa0 RCX: 00007f1a5d78ec29
RDX: 0000000000400040 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007f1a5d811e41 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a5d9d5fa0 R14: 00007f1a5d9d5fa0 R15: 0000000000000003
 </TASK>