Extracting prog: 4m53.428347749s Minimizing prog: 1h13m12.162701004s Simplifying prog options: 4m22.420696041s Extracting C: 1m48.639563715s Simplifying C: 0s extracting reproducer from 36 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-openat$procfs-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) write$P9_RWRITE(r9, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288, 0x0, r9}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, r9, 0x1, 0x5, 0x4}, 0x50) program did not crash single: failed to extract reproducer bisect: bisecting 36 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 26, 27, 30, 11, 11, 30, 2, 30, 40, 23, 8, 17, 30, 24, 30, 16, 30, 11, 8, 25, 18, 5, 26, 30, 23, 9, 29, 29, 22, 17, 14, 30, 13, 25, 4] detailed listing: executing program 3: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) (async) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000200)={0x2c, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x459}}, 0x0, &(0x7f0000000480)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x3, 0xa4, 0x6, '\x00', "7ef9f569"}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000205"], 0x0, 0x0, 0x0, 0x0}, 0x0) socket$kcm(0x2, 0xa, 0x2) r1 = open(&(0x7f0000000080)='./file1\x00', 0x201100, 0x1c8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) (async) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00') (async) fremovexattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00') bpf$MAP_GET_NEXT_KEY(0x15, 0x0, 0x0) (async) bpf$MAP_GET_NEXT_KEY(0x15, 0x0, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x9, @private1, 0x8}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000040)="81", 0x1}], 0x1}, 0x41) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000000), 0x4) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r1, r1, 0x80000) (async) dup3(r1, r1, 0x80000) openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) r3 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r0) sendmsg$SMC_PNETID_FLUSH(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x88, r3, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'vxcan1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'dvmrp1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}]}, 0x88}}, 0x20000000) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource0\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r4, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/4092, 0xdddd0000}) r6 = eventfd(0xf7b2) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f0000000040)={0x0, r6}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r8 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r8}]}, 0x24}, 0x1, 0x0, 0x0, 0xc880}, 0x20000080) executing program 3: mkdir(&(0x7f00000001c0)='./file1\x00', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x6, 0x14, &(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES32=0x0, @ANYRESOCT=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="18"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xb, 0x100, 0x1108, 0x9, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0xb, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800"], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r0}, 0x38) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r0, 0x58, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendto$packet(r1, &(0x7f0000000380)="7e778fbf6cb813be92ac6ead2150a451a013d0794da37d5a455f78d5", 0x1c, 0x4000000, &(0x7f00000006c0)={0x11, 0x1a, r2, 0x1, 0xfa, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracefs_dir/trace_marker\x00', 0x1, 0x0) write(r3, 0x0, 0x20) fcntl$notify(r0, 0x402, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180), 0x101200, 0x0) mkdirat(r4, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_getnetconf={0x1c, 0x52, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x85}]}, 0x1c}}, 0x40) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$sock_buf(r6, 0x1, 0x37, &(0x7f00000007c0)=""/4096, &(0x7f00000017c0)=0x1000) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f0000000540)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x0) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/memory.limit_in_bytes\x00', 0xc100, 0x149) socket$inet6(0xa, 0x6, 0x7f) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000440)=[@increfs, @dead_binder_done], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/custom0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) socket(0x10, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) unshare(0x40400) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000001800090400000000000100000a000000000000020000000008ea1e0001000000480017004e224e22"], 0x2c}}, 0x80) socket(0x1a, 0x5, 0x8) r5 = syz_open_dev$swradio(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f00000000c0)={0x9, "a75d7c32a93ec7cc77ec557ac0f3246d37db4494a12d8e14736407123b538a3b", 0x4, 0x0, 0x800, 0x2, 0x1, 0x0, 0x757, 0xfffffff7}) mremap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r6, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@delchain={0x24, 0x5f, 0x333, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r8, {}, {0x5, 0x2}, {0x0, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c1}, 0x80) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000000000000000000000000000180000000000", @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x9, 0x4, 0x4, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000005000085000000b000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400280) ioctl$SG_IO(r3, 0x2285, &(0x7f00000006c0)={0x53, 0xffffffffffffffff, 0x0, 0x4, @scatter={0x9, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)=""/5, 0x5}, {&(0x7f0000000100)=""/183, 0xb7}, {&(0x7f00000001c0)=""/98, 0x62}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/185, 0xb9}, {&(0x7f0000000340)=""/5, 0x5}, {&(0x7f0000000380)=""/175, 0xaf}, {&(0x7f0000000440)=""/106, 0x6a}, {&(0x7f00000004c0)=""/115, 0x73}]}, &(0x7f0000000600), &(0x7f0000000640)=""/53, 0x56, 0x0, 0x3, &(0x7f0000000680)}) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000000)=0x8, 0x4) executing program 32: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000000000000000000000000000180000000000", @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x9, 0x4, 0x4, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000005000085000000b000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x400280) ioctl$SG_IO(r3, 0x2285, &(0x7f00000006c0)={0x53, 0xffffffffffffffff, 0x0, 0x4, @scatter={0x9, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)=""/5, 0x5}, {&(0x7f0000000100)=""/183, 0xb7}, {&(0x7f00000001c0)=""/98, 0x62}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/185, 0xb9}, {&(0x7f0000000340)=""/5, 0x5}, {&(0x7f0000000380)=""/175, 0xaf}, {&(0x7f0000000440)=""/106, 0x6a}, {&(0x7f00000004c0)=""/115, 0x73}]}, &(0x7f0000000600), &(0x7f0000000640)=""/53, 0x56, 0x0, 0x3, &(0x7f0000000680)}) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000000)=0x8, 0x4) executing program 2: r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi2\x00', 0x1, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) (async, rerun: 64) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='!', 0x1) (async) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) (async, rerun: 32) syz_emit_ethernet(0x76, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x0) (async, rerun: 32) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r8, 0x890c, &(0x7f0000005fc0)={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, @empty, 0x7, 0x8000, 0x3d, 0x500, 0x5, 0x18c0012}) write$uinput_user_dev(r7, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0x50, [0x2, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x63, 0x1, 0x6, 0xc, 0x2, 0x9, 0x1, 0x4, 0x8001000, 0x7fffffff, 0x51, 0x8, 0x800, 0xa4d, 0x3ff, 0x4, 0x6, 0x4, 0xffff, 0x0, 0x2, 0x6, 0x10401, 0xc, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x1, 0x4, 0xa, 0x8, 0x3, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x4, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0xfff, 0x9, 0x9, 0x80000005, 0x12, 0x800, 0x2c, 0x0, 0x2329, 0xfd8, 0x3, 0x7, 0x5, 0x0, 0x24a, 0x7fffffff, 0xfffffff7, 0x0, 0x3, 0x5, 0x4009, 0x80, 0xb, 0x8001, 0x40, 0xa1, 0x4, 0xffffffff, 0x5, 0x10004, 0x9e, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xe, 0xffff3f16, 0x2, 0x2, 0x9, 0xa, 0x5, 0x2, 0x207, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x1, 0xffff7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x81, 0x8], [0x20002, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x9, 0x1, 0x8, 0x7aae, 0x5, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x400, 0x2, 0x2b0, 0x3, 0x97f82544, 0x8, 0x0, 0x0, 0x9, 0x5, 0x4, 0x10000, 0xc90, 0xffffff3c, 0x8b2, 0x10, 0x4, 0x7, 0x140, 0x2, 0x2, 0x1000000c, 0x0, 0x6, 0x7, 0x8007c0e, 0x5, 0x1, 0x10017, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x3fff80, 0x2, 0x0, 0x8, 0xdd, 0x1, 0x9, 0xc3, 0x20ffff, 0x7a0], [0x9, 0x3a8d, 0xffff9a7f, 0x400, 0x6, 0x1, 0x1, 0xfffffff3, 0xd077, 0x2, 0xffffffff, 0x1f, 0x81, 0xa, 0x6, 0x2, 0x200, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x4, 0x5, 0x80000001, 0xffff, 0x301, 0x0, 0xfffffffd, 0x1, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8001, 0x1904, 0x0, 0xc, 0x8, 0x7ff, 0x280, 0x5, 0xfffffffb, 0x7, 0x6e79, 0x8, 0xc, 0x9371, 0x4f89, 0x7, 0x580, 0x2d1, 0x80, 0x8]}, 0x45c) mmap(&(0x7f00005aa000/0x4000)=nil, 0x4000, 0x1, 0x20010, r7, 0x0) (async, rerun: 32) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000340)={{0x0, 0x1, 0x0, 0xffffffff, 'syz0\x00', 0x71}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) (rerun: 32) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) executing program 2: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f000000000000000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000018500000086000000bf09000000000000660901000000000095000000000000001509fffffcffffffbf91000000000000b702000000000000850000002a000000b70007000000000795"], &(0x7f0000000680)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) executing program 0: r0 = accept(0xffffffffffffffff, &(0x7f0000000240)=@pppoe={0x18, 0x0, {0x0, @random}}, &(0x7f0000000300)=0x80) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) flock(r0, 0x9) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000fbffffff000000000000000085000000bc00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xfe2c, 0x0, &(0x7f0000000100)="54ae1f8219560625baa794a469ce", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602ffa100000e000a000f000000028000001294", 0x2e}], 0x1}, 0x40) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) r5 = syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000080)=ANY=[@ANYRES8], 0x0) syz_ublk_setup_io_uring(0x3603, &(0x7f0000000480)={0x0, 0x16a8, 0x2, 0x3, 0x127}, &(0x7f0000000500), &(0x7f00000005c0), &(0x7f0000000600)) syz_usb_control_io(r5, &(0x7f0000000100)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000085000000854eb1"], 0x0, 0x0, 0x0, 0x0}, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240), 0xa000, 0x0) readv(r6, &(0x7f0000002540)=[{&(0x7f0000000280)=""/34, 0x22}, {0x0, 0x18}], 0x2) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000540), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000001980)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001940)={&(0x7f00000018c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="00012abd7000fcdbdf2501000000050014000400000008000900010000000800180000000000050005000000000014001f00fe88000000000000d59cecf5020600000000000000010c00100000001d8000000000060002000100000006000300e36200000500"], 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x4040884) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="40000000190001090000000000000000021800000000fdfcff00000008000100ac141400080005000a0101020c00168008000300ac1414aa0600150006000000"], 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r9 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x101) r10 = epoll_create(0xff9) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000180)={0x6}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x2f, [0x3, 0xc95a, 0x200, 0x8, 0x80, 0x2, 0x1, 0x7f, 0xa, 0x4d, 0xfffffbf2, 0x5f, 0x0, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x7, 0x7, 0x8, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x3, 0x51e, 0x4, 0x1000007, 0x6, 0x7, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x0, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3d, 0x8f, 0x6, 0x1, 0x4, 0x5, 0x4, 0x5, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x42], [0x10000007, 0x10002, 0x12b, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0x3, 0xf9, 0xd, 0x2bf, 0x3, 0x1ff, 0x2, 0x3, 0x0, 0x7, 0x10000005, 0x2f, 0xe, 0x313, 0x4, 0xea4, 0xa, 0x5, 0x0, 0x80, 0x5, 0x400, 0x1, 0x7, 0x400001, 0xfc, 0x1005, 0x7ff, 0x5f31, 0x1, 0x29, 0x6, 0x1000007, 0x9, 0x4, 0x2, 0x8, 0x9, 0x7, 0x5, 0xfffffffd, 0x3, 0x8080, 0x3, 0x2, 0x7f, 0x9, 0x8, 0x3, 0x4, 0x8, 0x0, 0x2, 0xb, 0x48c93690, 0x2, 0xff], [0x4, 0x1, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d5, 0x9, 0x5, 0xde5e, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x8, 0x8, 0x86, 0xfffffff9, 0x1000000b, 0x3e7, 0x100005, 0x5, 0x4, 0x40002, 0x1, 0x8, 0x18, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x6, 0x53cf697b, 0x756, 0x4, 0x54fe12da, 0xbf, 0x5, 0x3, 0x400000, 0xfffffff9, 0x8, 0x1, 0x5, 0x0, 0x6, 0xfffffffb, 0x6, 0x3, 0x101, 0x9, 0x4, 0x2], [0x9, 0xbb31, 0x3, 0xfffffffc, 0x20000005, 0x938, 0x6, 0xd36b, 0x51bf, 0x5, 0xce7, 0x2, 0x2, 0x7, 0x5, 0x3, 0x104, 0x80000000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x1, 0x1, 0xfffff801, 0x8000014c, 0x60a7, 0x6, 0x12, 0xffffffff, 0x5, 0x5, 0x8, 0xff, 0x6, 0x2, 0xffff, 0x3, 0x8, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c0a, 0x0, 0x6, 0x6, 0xb1c, 0x1, 0x1ff, 0xfff, 0xfff]}, 0x45c) r11 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r11, &(0x7f0000000040)="e2", 0x918) socket$unix(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000180)=0x200008, 0x4) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 2: close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff80a5adc0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) (async) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff80a5adc0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000083c0)="7c60933a88d76a2979d19b1a47363b838482a15ae1ca46df7c8f814e6f323fe97147d94c37aa14d23af92584e955bf5ea604da1371ebeaabf79f6229a064fddfd40bb55b6fc2ecccd91b7d7be714f4937db04551c462bff3ec4a191aca744d2792a717c814a88fe5e7127c330d2ce063c5ace17455db94d1096bdbaba282ab0eec92a2fbe9939807c200405341a0f8ff71dad41cb475531f48647a876cb61cd4897cec082383e4f465d2788597503edf9ed5ffb2113a2aead5ca76451f88699d46132a2cb30f1144d25c248f45c91f8fc4ae359f80d83af6966ccfe642a6581d3e3d66d5acbf1cf57ede53788786821526175b67c0f43de5058211ec7c59fc7f1684d816d84649915d1f9ef40edd517e32ae9e20f1d82065111ff318badea5b9af137f4d15eb2cd861525a297df3a048a5e17536212fd5648c76048f2490597ab08f79f003ef52a34cd37fb72922757188de4e1883695c8a600c88c3173fda0799439ef7f8f3ff30d26c60c528bb5b14018179e0290fa0bc5510697b07ef514bce316a1f101286472fc464c24eae6a265b63b98472f5d669bbb5dd82925f45246c453e5f66184f69047af37a12733117e6b7dc663a8aa2e2fdec59dee998f1794aafa4a56d312b3f7820d43c78cac7b3fee7312e028fa571ecea92d3db79b185c697833e18ebdeb1a1b7d48633dc6ea78cefd74a1399d8a8362879c2416e6850b483057807d080d9ad61cd1b3d3eedfcae780315c1b5c0735f4655f732b4dd8ba55cf84d29c9c6d06f3020e7042b209de37e51a7d17a930b834f98a4805e4ee18db264a63dd0c0949d6ad332ee9ec915a1e5d1dd649ad09022023792a7a59ff1d21c18d6efed92d65cfc27d0f953c35e8a3b9d7fc23ed37bc054bbd0f867a5cc5cdacdb08b3ee2dab67b9552d0c64df74fa945db0afabd7de792ee04264c8d3f3210be29465fc2af853830c59687f3c2d5b29602c1260b3cb31e95beee609ac3bffd7ff00fc97089f5791f670bc9fbb7252c24f981010235aa54cb77be24d9b345a1e21ac19b9667712d3dd474d478235f9ab438b36b0b27151c3f403c50b0f82379f8fbcef88e3d7bafad1112804d0726b43617b332bb55a323a6eda3a7db340fd9a5b625d2f992d084d59bc05144a239dafb782663bf5d3d3f17628e5c495fdb4953fe67ed7011ead6c7202b037374f8e819259a7ab5c617ae57508ceb1ee09a79fca924ae2c2db0c1f64570f823d29f703d09af1053a3f55014e1af9f0c72710a88b26bee1735cd1b7d38c499b04aadd211efdf60a26e51bb0ab9e22a40fe86c99a48cb5c9e0a50664917279bbe161e80294192a3ea22bc0dfb4804708e8d0573a98ef6c056dea914e3bd7a49759b4438dda9ffaf86c6995ef526565c15cae88f4b340c074932fa0f161a25294b3417ff2555109705521c4fafd034b9f9e5689efa1a5003d510a1099652b46e6797af00e0328670db8b29d48e96a904f998b7ca59a348de713476785f1fb76b5ad91b4107a745ca43e67c6257b11571d70a39bd1913640514611511c54a3efc03d54fb29467973f95a7396498088e935428f8fe6021f61b536227e4c9958e7ae8cc599d8fbe5fe4218c7405b828fa4e84c92e98be66d375e1c3d31537180cd03cf0f0c3b1592dfefa9b8466bffe96127a3dfc12784ebf9ff440d824eef957ac3fe1e457a6fee39cedc00c87f9f1bcc68c91333656192f2479461ee3def59bc7cf19c8a2f36bcdca3c173264e5dc251f15d27612e869e8e18a3c412fb1c6eda45364732e6b552fca8530c4e8143d67b3697d45d5286cb5d2478a8a4d144657277bce97fea1bc405c40892e37c785b24e3126942ff0effcf6fad105493b9960a5bb1fc4dbc4dba44b141c8841ef1e44901f9f7bfe5cc942dc31b514ba36cb858d9537a5eef5cd7f6f2c2a7e5452029aeff5274f47ad6360257d1156e776ab89dc9a7adc2e151454b171f785ced26d3c69aef8a6fe53b4915977f11049a1787a3ef0bda32a10e4ca92d31e02eb77c575562f173943c119479d10e4714b86ea0209877326163813c974650cee30757ae5758dd95be001cbad0fca9d8102cd6aeae0982c017040052983c76e9733c58e94a739402451555e59e5ff0932b09ca975d66ac3a48701c7c98b4fdbf84ce894f02da3da2e0d7737b2cdd4d5970e003bd925c987fd6e17ba109ff50398869519b6e6b48141408d977d973ae99e12f541ce28ea765f72d9f09e82bd9430fa7092f67570a4af1010d0e2ed7d0e2c9f5c15488fc5369fa1546c61472e4e05c38b6a857e73fdd59f0946d0547fce3415a606700286a5272f7933d33bb1a7e5e57e20af8374524436d25df2c6e5e76fe5ee89d89643c939ada6997fd53ff45368fab6e952482a7bbc3e75e9dff4e830c836b6c2792b7ecaceab5959dd454a490a54147e56327f7187382e2e1cd78df1b7c603f4cd42e776eb9f60b0ce9c3ea3392bc7b86ea9c7c4bfd7137b0a469b83ce4cd25ed1972904d5ab825d5380846ff1ae33bbf01366d61cd6c067becb2800e6463f40300f8731d50c5ad39f8de05d9100bc0265b6fcbe548747df89e614e7767b30e086007c2435ac5b62b9ae6d4d83ee1a61e4fa608848dbc1d229bfffc3e1c05d364adae3d21b653f9a671e42f740dcc3c8b10c0a0bc70d093fa8d2b99b1a09e391004c0afc765b4aa210dead05fb9a5955a2291bd4181e752ace0db6f1217fdfc56aa2392d081176a907e26d295f03321af736bec89577e975b18b53af8a3480447e8aed18718abde41609723d82cad1a5b7a17ac578310b7fd6ee9c31bfb5def019d00eae869b8ddf9f135c5cc325026da2c6e8e5ca9f30b928c0ac884409f7b8502c4df1d5a4a1a64f294987fb94c2288de8d16dc6eef3206d38f2d0f5dcb13d43633a7d0e2f9f35cdcab95975602cb5ce0a6b6833a0b96a9d3c0fe32afbea9d9a92b86dfe5ab1caa7f77d47ac0410d81ac624ce7993054061c2e01dea2c64f0cba89ee88a0fa54c2204b74cab75b08bd92409f14952170c6e3db551f77bb5e892380a7923821da934ac6a3f3133c0ca45828e4b890ed8e1ddfa7cc0fa3d69823f18888dae08bdf8e7633db061b47555360f51493ed9f46426150e0d85744cc1df2dd55f1c02d831a4ff90173af5b9feb77c5f8d21b75a1264e53d87e3893bd32c5cc8aa3fac0547307ed481b0df6561656b144580e48e53c58783424a4cfe99b06cff968c641f05f91c141483fa9bf94ed2a70a2f4a8e809a375a11bdb1563b540bb3a0181f48d165b781fc250a5a076fc2d4c1b63d5ebc0c5bbb711f7955faf7b581560793508806dbdf490ef1b358476157784412d6bb11427b4c937e63e17044cbfa79fcf159c1e632d2cc1de85404327ebbbf4b7763184a059d92ebb6e19a6156defea425b79a4f9a4651b47d1b9f8ff65e016b62a78f4893e0bb621446cac2a6c3f7e57092904a47ffae159e4d7ca0a0d06970dae6b7e7261f70beeac02f19e26caf7e745c82690c4fe9483dfdceea399d6d254181035d9baa211e87b94bc178d6e86b5a6bf012ea39223ddeddfc4731e0c8b5d6d454e76ff6018fa5d0039f991d56f78d953633b0e2457c67f5d06f35940d75dad0904dcb9e48033f1a833beb1994ed2fa58a0d75dddc8e570eddcfd12bd2239f1ec001e940b203fa73d87e715a5d431dfed069b77f9722e6f8c0df9b4bf6374c7848b26424fbb5f75c8494532c1ce6b825e55aca77e056a7f0ca42b291e96d1d5e92b3b628ae7d5a2bb73eaf8deb5f80452ed1a47afebfa084eb06c9897eb70ec3f4aa32c5413b5118ae57fcf5b9b236099f0d8f3fe5cb3a2f0def902057fd26d2557168322c13066af51b882be00ebcfdeb6e33d294214ac4e4390b2bbec78be29938ba03ca9f31cf36d8645d1f8bcf752d6d9ccddde2e8cd3bd90d01e5c14d37666dd2e5768bbf1df585d5e0e986adbe379197d1aa77e4dbdf55e9d7f64a5bb4ab44403657913e4723a6ce5196e5a67ed0206406940202f697e2c80dd0efff938ac79458661761846ba57911d7d86bd09d94839920176460deedc3f13feb96e28554ab01cc95bc9764bf7527b0153c45955cc7e71f97ae452f2c9e8277ab66535d3f6c87283791fbfc7de2cab1313e821613b0db320985c9ee8b0066ca4a1b8da0ea43c3f453b9983a6d5cd01dcf40149fd4f441b7f593987a05cf41088f6e474c1a5a23be48adaa73d8e90a1c4857e7b88743345014670a9c74d748765872d447f00cc6be4b03e5253b1709d0e47e2532347e0bb748bbd05f2d3765c881325fbdc04d582ff128b38fe29c04e75554dd82ae6c81fb15d93cbe96563e50c46d65a65eb00890953714f5c1c198566ba6de1db794297f948f0c315d433b77d867a9db6cca86241cbb4db80fb9b1782b5bf0a57401b79644f45ecb9d8642c6aeacbfb70d8b8429c5e867ff780a19e8cd80cc153636f17e338b8c069a54829c8ae6cd9361fb10ea5eb231811a45336fa650f060d21c481580456ecacea8b5ee5050fe84ff5463df2d7d5d475fe65da9e848ecf65769dae6da4b7977d5b95307694889c703f8eff6ae51182dcd32ec27c1b453a216913a79653977ec256ad37739a6e99b6fb0f2b2aa3f1f494c01c2a7f79da0a6ec6a0a855fd0efebeec595c1dea772d064f9c046096069285c22f117ff8bd16c4d003323692036a22002f3020d28a94eeae09894017fce5747c1374c0dc158d4d930452ada5a1c4d00ed805fe14d4016d7bb5ec9b064c5e595bb63c6474d94167839a8680de9f726c5119e73c563c15d775a78425562eae4a07d70c8746de4514fde36fc0ea1c7bce94f016444812c11556d8d82bc7aae33d4eceb684208b6eef7679012ec5549144a2716226f3adab8f52b835f7704b11443df808d5921ee920899757b438d5c4a0b50264840cace40a159356fa271b039edfc696844afdde58fea1787a5f38044cc50a9978d1412930f9dba720b6036f4cff01b04b5bcbcfd4b4be2fc37742eaa4ab2cc0dc3843d8beaaf5f5e3ef70a5c48bfe26502f34647c4a6b0b6daa2db6ef89d2b808647d7ecc671be7cd014940e8c2b1e3b59f4e031921f30adfc0c1b432e8f388fbee20948e19fee912dbf7f57650abd65de07807495e273a78481c3f21dfb83e5f8a60b5564d0699a90c079dac2caf8f4c8a3e56fcaf9568d1b9120803adecd3435d9134201576ecb332296897e81a56c0b229ee3a57fec2212c9ac0c771064c3cfece323b97e8cacce390d58cefca0417d5fdf4eb9acc1c754d5d04e9b85a62e3a19d8fb1e8dc23b63ab8dd4552439f3c90ce0047792d769fa2e784a8d7098f34f11423ee1a0d47639d7759b8affbf50e77e74e4af57b33ab87a2b049c84de6c55b341bc51ae2a107995bc8d91a75cb455af7b95f5c49539aab76fdf159bc64bad8bba493fb49c5e08f2cfa8a0e4c5ec35dae9ed7e01eb24b54701ba7960a258e2428f50e185d1dbed1b566845f136302d5f88f5b3eb244e611caa6e1cfacc9b0c51d7e56d56297c08edaa1f150e138370ca12595598f4d2bbc7639adcb6cc051c71f2d04f638d570deae96842712bdbf68daeec73478148254f709776ffe187ba4b38769f04489d87d7af42c7dad6ab1064035c5c61e69a95c660d3696c6f66a43fbd57a931ee172a3eba71cc0b4d1a9c1f6a28d95489d0dc2a67772457897d74f51e3672051593e3a9624c3778d9dbfb05ff3aa672b3c1cb83ebbfc3a0212f8bc1366a0f32b62a3f698f6ee31d12388d43464955c72a6e9ed5dfc7deb7f09c7f23f01dee2b3437ab5af05ddc7f030afb8b714a34573b425288379bf84a7b5200476df88b3874f785ec3cd1aa946558159f3fdb9cc481094f1bc6a01a11fef9b56bea73a5124a62456b79f22dfe60ce8e53989c8b1d0c031ee35ba2bd408f99ca48b6d9ca1414c5e750d5efc5fbf225fafda284ef80118964292d18f77a01eabdffd68f8c62d8af07a5a6d5a23464c08e3bbfce5912abcc1f4acacc3d4bc0cf511cb9682dc5fc775a0fa0229d6260370989ae8850ffbf0aa94bbef450994083f4b0616c7f481fbcf373b4e6f8cac4949f13d9c3b55e27275c8fb6d95d9b3ca9c7df28b8b8331e81fbd8dbb9bb63e19f8f6a10ef16d1fa0b000fb72af4894b4d51663e65d717028d192ca935ec17aabaa8602867afc5942f6624a57ecd7572521c3eca53ea09cd7519c724c19ab89b63d1752c1c503e732c72b0f0d8558900ba0c575b918ac6d4fa9e0ca8584876c654a83000df383a4cf41ab54b8f8df44a0e59499dd850277c14f6ee8bfc86822dc473b33634dbb638ca0de90a4e506854d468894d8409c15bfea5ba91720a2daa2e4946f5897bb0b03accb214c3d06ecf711166202d24828fb4b9c96ae0db50ce319a64750e002198b73ebda97dd96a677da9fb59feecde57ccf492b300667b743611a29dd4b30190450c640b2ae5da517edfd88a78c8fdfbaeff0bd17eb334464c0dcb3b851a9fcdb4485bac45262bc985de4cc2ba2005e82549ba80833641a4e86cbb8e18b960e8deb880a3cd8c75941fb0c6969a6cc55977d9c970dcf7a7506e581c795fc59dca99f80486e761bce7262407df3b4f0769b295011fd4f568c18efe53a1b058b43472d07ed4860f38124678994def0a6c72f84f0b12280e91ff4699ca93d12f8c6ace9d2e89844602d52d0ce1acc16d4faebeb649bab4e3b5c16973a765e9488acaab196b5aac840826609934b99a9cc513f6a546a542c2313c5ec5a902ab4a3186ae97156b27216aea9879503d402314e7800714ad6e78cb8f627a4c80497efd68bbf522aaab7b68653236e73229378cb198ebb33aae5e4a9adfb99fa6e38b74ca1af9cad80ec974039769c633694b161628c3e97e49a78762d30f8cd513b9df0f917107afd11d77c59898ce270e60d91ddb526c679b98500934338a8a4bf994ecb6078fa2ce773350184d81d431a5e31fc672d4be414b435b779135f7f60d4a1269c24d2c135d41b613f43db878c85a414e9e79b4c09ebaf3bba6a000fdb59f9cd91cf589e09d81e41b84641d7edafd018396c2f0243de265a6a238fdfd00e07c206ea6220f3de46fcdc1ce39efb01c8569b8c1c3a3224b5dcf909a13f1d5e8ba2eabf1d533360c3f96a8628152d3c7467c9c2312f2aa4e2f5e4cb08519f75cdff4691263fed7cca0f8ebc7d0890adafb0d758794b4d82696ae782b70addae7c67d4bff760a1c2ebbab45dacccb651b2883e464aab45f98a69efbded5338ae4ce54e66c6657b40f040ccf698bc1f111ac04242508164c92add63b35a3db0ff11f29405d964c76e9cfe90dbd035249f443ecc2d80d5602bd805de38907efd1729767211e19e56c15c939c353ef18fbf56f5b2443d16354022a22ce835572d8b039face4147403633daa3823c3b6dc20f1675a28dd28187edef3d38fdd5e21ba596fa881daa52e024088aae82744d04699311228d7b1878ff726e21627f91a3e58f55e88c48d3db3592d568de891e5e48e00a39be19e4c43553d9613c34b1df3d96e3ab26a759f57f7b3c3ff971f269a51a953e23c646b39836149f50b11914d5861479d03319bdff8630e331c60c73eddd6cc3f041383b598d8055488517fcecc9bf99508bcb1e4a3120ee391ef8487265d66994dade2343717e584fb30abe59cca126ced0847eb2c4e4bd6d5fda67c18a0adc7a0bf59610c98988b3a08ec7130f3cb69be7d7ca0555e92417f25306e79b5a509f68c16ccfe8d8c69967a9f80b87e163d414efda1a9bc2f0f691b64cf58c8b6636dddf9140670d2d0d883401afc51d05445b49b4d7063dbe0c2f7ac63a6b09ce465ef5953b9b99bfa578819716d3565e4fa0d95a2e1266abdada47ece5332dcf9c4ce68ecff1397669db3fbdfa22fdffc39eb665a951d73d7fba0fafe0c02ca69b4ae43b5a251e743df672d3e5c6893c7701042a2366f7e3d9406235993f3ed63c7356651acf17cbf6229bf52d1c895d992378457bf035e3d79b58de436966e2ab4236194ea87ed0745216542866cee8cc92b1abc43b5d4628d9bde4ba674229bb83a9aa15613d102e1b39c12e3ed6095284282452bc0f63557f06aaef97f3a0604f467070a350c8f94a7d37d43c81c6b6f71cd170dcb742515a58baa40fab685a79ea8188f0d6f893d1a1a86b1fcce9fd8353c9602974ca315fd129459b88f6129b5d073435eac7c6fc00ed5da18d27e72ccb0b5e755fedafbd74770772f79930b2f5db8451e1ea004db3f826df026f16dd831a68737476b1d69d4ed46fc48ad14425a455e689d51362d5b445da484950ed2b0943e5d3a1e88afadb66f7e817b778ac049c91875a626ae347c5ef28ca1e104f8cf7f038f5551581e3d6375647777de8ae9854517217887a957527148d8a0438b5958ae7774267bcbb6ebda5f2af12454ae2d8dbaef741ed936bcee0135cd440a83146446ed63b8e279f9a02c64b8bc082b1d31157e86c7cf374af30442c2c6e91a1909289e7f193ef9caaa516a1951b6042ef3407f55b19b28646357ad6f06913466cad44576d39623376fb47f5f21a6492e9b2286bbf26e539815223ddea65635d1e5901b91902e888b8f22d8fa9989bf3373bf95458b57fffe8d5cbae020000004742d77bb799a985b245384cf66ec38175a081fee6d84d13f27409e51bf9fdaa92a596058d280f204ea98fa8468266a5dda479196a2111aebd5638b890d3da16033c6135aa57c97bf3bec417059e1e7d3066a1d094d37b05d33719e62ee392ff7091d02c26375b56a2cdb0d76e3f93dbb4ff256eb43aa281f7fa0525b33d68b0d9bcb4ee5a7787d3a9a51d87b2395b7848113b917230bc4329f89beac3d03b72e7b6e9f2404bbf5cda91dc876246bc391f6107dcfd46bb566b9371a85341e09ba0355de0b340d319c96ff0fd7f9b7e75847ddc5f902f67a109804ecc1e176c20a14d07a8726a167c2d22b272245ad607ade6524b3751d6240a7fa924ab7a0977ab7a8d53ad12598eaaee42b60fa115004d3fd5a81d5f05c8529c43bba0bfceecf640d2e1d00f1de89be887a443232d32945a6b93067b86b1ad7690bb7451e1dc05cb54368de12883a65686eaae6c572cf7ee3cafe8a37da87d62d5a19b1f0691f1a617786ee2a8ebca5e085e0bd239798946a43302da7d369feb1e9d02788378af55e7af698fa1996a0eb27ed1b7daf937331f1fd2a23d77fb74c32dd73e314bb03d6651125606f499706f19d3716990c359cd726dd6c1e670671ce0bf18db472197a36e99b8b579fb5d4284ee9d23b9774e2d9fcd47aba2faddcbc53e28cdc4b9f25417eeb8cf01a3d0cbd98ca0c83f32f935742465dec5ac714fdfe0b5fb679937cd44df27ed81ca21203e400cbcf8abb36fe86d5f99a0c425c4321f23e882ae919743e17f927bc4999135d50452b89f1fac9107b5499f3bbec5710aa6804c8b95138595ef043ea4da063a540f451917fe1facec0de011597104a577bee29e6ecf69f44892282feeb6afcb0f5ea17c3272a5fe51bbf69a60d4432358087dcc1e204c325b12fbccdf2e946420691d611d286f51d17a3e5eefa3c74351accede359968ca779b1d3035c08cc9ccf5bc62b1520efa248e5cda2bb3569dfd6571d9219486f3aac82c63b4213f8b2052f39046460557a83b3aac740182f5c1574efc752c3d8717551a554717647eff9aa015d6f484c647aafbf8f93fba8faac812b0f51beb76c0e4c1b85789f8b1259dee1bc8a013ca8b9b7e59143cc9748020a75d2d099323294179630fb42344ce9e986cff8af1287348219cfb1265b04c4225f305a6c81efc1e3176c2ed31eacbe1ad2d32dee14bd66c140ebe4dffb2b45d87f093a452cdbe459b8bff9b2814478dbe2fde437887534d5b7acb3172508bde4a98bd0453750e6ea49283e7798646863b11268ab352ade2c3a84370ea08b50245232c715efd33fafee4b5768d75afa9d8c5cc7248516df5449b930a6127e9d287ad09c9cb7cddcd7926383312627037defb1fc6c788ce27ffcb4fd2be4203a3caa2e52ef66fe74ad5a5bb268054ad9c518630944c0f2954cc16ca0b443bbc30e551533c45961c4e9e946969598e011358d60ac38e594d81cb32207369b7ca01e410b36b0ead8340147ab656c0b811a3d91fab5ba8616bd4e37340db79616d9b62525f53a2dfe0424ac56cc7ebf150158257ec3b1bec84dae3dee711cd119fc7484664ff23c173c4edde30de8c3fbe715532a3038dbf2c58e660b1c4ce47382f0f6dc175875a06e6c81f135d674854dd97e9b869965b2b570edf514959832cc6d2c6a73a0f4942b221688349aa3e18fa1b5d214c1d4a0a130b5856ba1c053392474695366691e49524335143d671858b4fba20afc81c38d367d9fb7c576a6bed03fd1b6bf8239acaf4defae336dfac2105e8cb557fc7e925a8c448836ad2007b7a861f995fc3ab468502d656d51031799397a361376a257829c948c00756f472ed7a6b90b738217ae47f5360fe8a0abd912a57b9c3b7e8bded887b394c820f5fa04f4ce9e2bfb686292a8aa55a78fb0db03947e31ae98adb3b4404275696ba63c67873d8b2dbd146933a67e0c3f2ae8ee310e778c9ae5cf11d021af9530c6066ce833c3726b600a5bbf614d4099ce5d09c0ff8b29dfba32882c431780eb48b7ad19c90808892795ccdd0cd82332564daf404a58986e6b556c1dfb582fb5e9c9febae027319dc90a69f0bf37ece6392f2c1268a0dbdbade3f10f065c4936250d0230cbf7425d68bdc65ebc174039df0a6ff2988cfbea6055e73384ee5ecece1f14431592a52b3c2e80a5d3ad6f8197bd94146f968ebccb8f0e2180d387ebee3b9269c616ede15389e9f61fd5a23778dd26e0c40321986602046335112a2022ed46077594d28aa01bd63a9affc8df91e60e5d1e498f80c14839cf335cfe017a9e15e04768d7a36382970a5ad5db557a9133ad03b0131005c9c78b3aed1978df4939f967cf6254dee706bd459dab264af3a857adfe498928be418fbd28e3576384823fb629a927e3dededee8b1d6a5fca0dd1bdd8ab6d0c6d5d3bb5e29a93d2edad215903c94af9aaa334f1be42c2b9cff2d28fb18f334534770650cfc2c60693a25f829b1167c4a1a75e244ecd0ce73fe7badb7556d0502d99bcb6341bf82f64c36da7649718005826c6f681f92304e6fc4f667d77755cc6cd40611756dc2bacc31fd67d60facf62dd23345be3aa04493274474c298b16e8a0789add54c58e6591d089783956b45055ff401788f14e2333bd2bccd81412d0aa82ab2c19ce8e7499e7056b435ca4539985734a0ae012903d790265adf79faf61f3b865b4b4a9ca968da561f23a537a411ccc13ac5ba14a85bef64f3fae0e0bdcf9e70da55dc2c44f89d263c1a44f18b50ea3a02c073183e9816adf7d841d597931f116e2b325c2908545968b863e520098a295a58d4261d0bd08d1cd77a7eac8a64feb114f231f9e760ec6d84634ebef6d1b24d85fabd72fb15735390c0aec246c909d5c82976110844b5bfde94aadfa6a89396709000a59c71331ea7ece5719057c797d57c0a4d2aa51", 0x2000, &(0x7f000000af80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000000a940)={0xb0, 0x0, 0x3, [{{0x2, 0x1, 0x9, 0x1000, 0x6, 0x0, {0x4, 0x0, 0x1, 0x7, 0x0, 0xfe, 0x8, 0x4, 0x7, 0x6000, 0x8ce6, r2, 0x0, 0x1, 0xf90}}, {0x1, 0x6, 0x4, 0x4c9f, '(%:\x00'}}]}, 0x0, 0x0, 0x0}) getdents64(r3, 0x0, 0x0) (async) getdents64(r3, 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() (async) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) capset(&(0x7f0000000180)={0x20071026, r5}, 0x0) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = socket$netlink(0x10, 0x3, 0x14) socket$l2tp(0x2, 0x2, 0x73) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r5, 0xc, 0x0, &(0x7f0000000f80)) (async) prlimit64(r5, 0xc, 0x0, &(0x7f0000000f80)) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r4, 0x80045104, &(0x7f0000000080)) executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000000)='source', 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fef8ffff1971a4f0ff00000050b706000008ffffff9c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000004c000000b70000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761051ce540c772e201b2de17dfdb5b60939d5d6aed4062049b87e03e2cd18a77dda613e0c64497fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e015064716897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03440eafe1c8660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1423], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) dup(r3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x80001009, 0x0, 0x0, 'queue0\x00', 0xfffffffc}) write$sndseq(r6, &(0x7f0000000000), 0x0) executing program 4: r0 = epoll_create(0x7) r1 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x60000000}) (async, rerun: 64) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) (async, rerun: 64) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1f4, r3, &(0x7f0000000180)={0xa0002012}) syz_usb_connect(0x2, 0x62, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a05000000000000000724070500000508240805040004960d240601e2030200010006000609240305050306058109240306010304050507240405"], 0x0) executing program 2: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0x44}]}, &(0x7f0000000080)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724f, 0x0, 0x55a}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010027bd7000fedbdf2500000000", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x24, r3, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x24}}, 0x0) socket$l2tp(0x2, 0x2, 0x73) r6 = socket(0x10, 0x803, 0x0) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r7, 0x40046}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MTU={0x8, 0x4, 0x6d}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r7}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) prlimit64(r2, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x15, 0x4, 0x7, 0x7f, 0x28, 0xffffffffffffffff, 0x5}, 0x50) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x18) r5 = syz_open_procfs(0x0, &(0x7f0000001380)) getdents(r5, &(0x7f0000001000)=""/4085, 0xff5) r6 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0x1000f1, 0x5, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x0, 0x8, 0x400b, 0x746f, 0x8, 0x6, 0x63, 0xee, 0x4, 0x7ffd]}) ioctl$COMEDI_DEVINFO(r6, 0x80b06401, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r7, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x2fc247, 0x3f}) openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/webusb/landingPage\x00', 0x1, 0x0) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)={0x14, 0x14, 0x609, 0x0, 0x0, {0x1e}}, 0x14}}, 0xc044) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xd, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r1}, 0xc) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(r2, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) read$FUSE(r3, &(0x7f000000a400)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, &(0x7f0000008400)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9474a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x3, 0x40000000, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6000, 0x0, 0x0, r5, 0x800}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x28, 0x2, 0x1030, 0x4, 0x0, 0xfffffffc}}, 0x50) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x105842, 0xa9) writev(r6, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000e00)='t', 0x40000}, {0x0, 0x40000}, {&(0x7f0000001000)="d6", 0x20c00}], 0x21) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r8, 0x4080aebf, &(0x7f0000000880)=@svm={0x100, 0x1, 0x1080, {0x54000}, {"104a209d112568e89071c7db685a423567366bb78bc5ac9657b5b04e75319215a8fdf398f2801bbce506fe469e91c676cc13af7b6910ebfb77bbab82ccb774e15c8dbcf9ee26be97bac77814a789718b46d414f440a1ef58790ee7c99552d241c2132b0847ff9b92d16e1dee2a7d1dfb12e08447f01fa30d587318edc89b0807d5b3ce08f656b0aed86d540ed99a08181bb1afb1f95474763bd56d88ab84363616e48b8a606ca74ccc624fd2b9f58640285b75370a3d7ad6a1c05c6b07cf5fcad7e1387c68908f840b5a9ffc876f138137e17fa6bd22c6a55c75e0f0d47c7c826649f9e818f1738c2d4a97d3deb44166b03c51b7be5f6e4f29d04536347566e61ee9396100892878e4bed65c6e1fb009a0fe2a936fd7ca4f36c9b4e350cb265ba3c1f5002e65f9c677de8edafe2016d30447e57a20d7ee38e872e90cd7c02c8826cc5d92114b844f7cf320c9c9122943c1445e06770dbb799f4ff323a5905caa534a114867cd594434a3c44e36d7559714fc5d733db20256c7aee4ff5ba6373dd326637b2b0c793dbf31a2f250ea202f6b23da35f837b4d26df40842243aa09ed05d0f236e37f4ffd95d94d41eaf13315d3a0da2fe1ab2d70a3684572b8a46852c3d2a2765501dac30d5ed83df330dab254fc12d7bb04c33e118cbf656f962934c2cd0a381ae9294ca6773b09e7258dc5d4959c16a7ec44ef596b690a13f2c734424bdde96ace1128a9f53adb528b267e9b592de137f53dc45ff5cc304cd5cb06a65325ab455eae2253afa29bf818eabc597bf7895996485596c7c5506464a452a14498227a292d202c0fde0f6780312d26ad682c262fa2d7618b4003514173a8ee1e2702ce0f64ceb662a5c7ee7c5c4e1bf019c0e1464b1f9e5f1397fc8ecfd94079450f3596fe75dc5f58391221c045083a1cc8b1607f0f96ab46fa9c4cb7dbd281dc85cb7ce6e9ae508afcc96c6e673e5524fc55d906e0dc0262a27f1f1d645894354a299ad84462824afd549865865b0851a47085e752049c3b51fe73ae35ff457b7832b5e25a03626a5905e117e44fbdec9f8f524ce6a38f01f34d4a86fc1e9d3b92e12cb91b045687086278055cfb95cc81c108383d2e60a5a7d15f28a482231fa6ea3035f36e4fce432184f9391ea0bf07c7bfa4657062acfa53b04f4f4be7fd86a092591d0f03f5a0a47acfa817ccb07e295f1bba348f731565c5f22fb0ccbd70beadbdeeb4c75221fe61db738b8755147f72f2c159f4a7a27a4436985d6bf300207dadb8f87c0f05a969bf0447a82b527e292585946d1cc43bdab43d0ad16b3170f6584e41a347e81d3088cc11b2f94d618306ebd8d09ad4028411931842db91d1ea1c512d10e5d017c8806d3a2fc8107a4f074322b2780550c86597ec82bb027c0461da7c23b139f3f17a607392950ef37fecb19a9784bdf30fde2db531e4c01edf4fe2bfe0c0ece480606aace8bd2d4e1ead5c7359d94fbcdacad93fae0c11839bcb458bf6ae98e8bc118d90a4fadaabbd6e57701da53dd95ab9bc0618e8c9e0e0fc5aecbb6c941fe18623e4e80ea562e571a278781e09a36bbf01f3f5a62b4c3a77c5bf6f5ad5a08c348d78deadf565fc620de48107af07b96871d6b1229a731d9556710c809fcb6500800454f55c9668d34470bddc636a4dbc6058dfca957b9b594185726c84447d07eaea72fd815113ddc9d981a6992990d966ea38c5c75cc641bd5e8e9889506ec23d833213cce81d09aaa030a8e25ee791d0d67f2f0da768b4d3927aeb9a37211d6dd2095b6c72fb140885b32e4d76abcd4cf24018607bda698b1225845e2a51770c72da2e3a9915c01be522933ffc01f4b90ed232d6b816530fdece572dd8125125d181528ca77afddfd1b7489d1c86f200c31c1d3d809e0771b9ea66bb1ef13ef969e2b8681c3dc79fd9eeaeb9eea6dd94b1107aefc21c0085f90f708071b8c8ba97b07767238467a63655073c24c930c6b098859835abefc05db2c42923f0f2872285c8fa4a278305b91df6e4501aa45c6801db95eeef75d248666e70ee29f5c42d195df3e497558dc10897c24a469cb8a7a7e3bc3f1f0292812ba394faf51464fe3f5d353a4f97abb1f63112dd86f72fa97632344a95d5f226af36424c1dfbe97901c1ad36ccee5940bf4f2764eb6e184f3d3acc62db3955abdd9b3b7e0f77ef0ffb8d89f372b6426bbd0996e23be48f5f5e7c0024b566ed2cdaf2ab088c6f2ed8d6e2ad25bf5985b256c3a7e63dba4db89c83ce81195579f382f13c9e86f765a3681b00bd7d5f92094e9869cafd2ef42b5eb2c7476c108780aadb934a4f017a8d7e3dc8fe6f7883dfd24f2d5b4c81f858a3d20b02fec9f3acd4edefe84656c16bab632145a3f36fee02e09d83ddacf8a00b5fb9db46726fb125b216c5e64e993466b74e8b5081fe4a567011ecad3be9b9d3349a2e6c5d04ed2bde385e8ec41597559d49a8a12ce71398caab5e6376eb2610d9c052cf9608b84295fc77de070b749ed2c8ad1dda56b00312a08ff88e54c943974d48801e73dbad3393947cd6489b4cbe9be0309512e75266c4dc57665217c5b2ea40353014c1044659f5a47977c1631b541d2e60172dd5bd51929a6d45ae07d49a05ea92fbf09de10ad903ab8c470408f6b9a511db2d11d077e85bd3e9a5cbc886eb26f861c79d9cb2cb31f9a1ce59995bed077805ba13ead7954ef8005cb054f5df416f574226f0173fac625379ab307975f0ce9bbae5720a76da4719ed88e8f3bf4d15ad4a44be0f8ec2d716eb58637be7a2e64c5e6fdf90bda38b0fa9bf56895a8bd68afdcad6e1caa557d3aa314a581e96029369f45803018f4584ae1cedd2e598617a99d7c1feac50ea9970ef1b23f7d5d55f26bf26f6172c3a7f1d4024b1a822f012cd2e83f0da75ccab6e17478bd4ae0def7c637f8dda21258de07f08edbae2c3263e8af761b9e0bc5481750aed29e7e0e21af21713e0fcd412edf3a755e9e32086b65418097f9e83e6477fa51b66f433d3bb4fc555f6372beab981d06bd1f2facdb8c85d5e77503ad3d53345cc09a169542ec1247efebfc148f04a69be0143e4a4d0bccee354046dd0d73f5d7ab538c721ae15dee654f9fa1aeffd79b182cb6ac22eac2200816e4fea820899a6610eef2eebd2be78fcbdb702659e1faad8083a66e72a0329dfbf2e087de77844e8d30fb65d4ce8222e4c9da0877c3c4d56e899af7857e440496850a120114e2376e8f85f7d8a7545cc49498a94d098f66a6a459674d8c5fcdc55b56ed5c48eb0123a114a793d30609e066f768e92b165e831a2eb0b5aabce0cae46ccd38dc8b19ed7d9e6bf093655d530dbd2755b455dbccfe09934a0fe8ef1f7f848b1b0cc5473c449e099c8f4a801fde34d39eebced9b75681f80fed359c2cc8fb737781dc0ac6705e2102f8d39a5ddb252a9881d85f149b62a68652b2a23782782bc1bae76ec616b027a9e0e518dc14a1bd8bbd963554834c7cf9f10b7e9f076312ee8f43366a4a697e40f141a6c5547e5b65a8f74cd6970a6cc789579bae65f855bfee9fcb2500de48ad1f1a868c7cf7ab8d2dd4796582a51ed5d6427de90a0175bb7f5a24e25744494ea525b2a90724e3a19150d709c8632a43b8a0408a35034d3084c809940b69406446973a057556f1e3c4de93bf8c51f05501f0b15f5da09b7c8ead00bfac51cef635dbd5d5222e4e9c150be49f04273ce70f7d2a6cfda5cc1807f3d33921f07485b9715ab2c670588e672747763d7070f1dc9cf1dcea94164716a918b9954e472f07cad8af84a70263065c8a36f8d447d0791471a523233c7a475477de22bc12c7f890c16f78b15866371986a1cf8216692978df001a7918b7dc73057992be00784f506ff05eb3fc2ff54c62661625f60415d9b7aa7392d28fc16992626cdaf77e0f794297c3f5fcfc5bcfb409704de9149b555acd6a8a6ba164d92706d89d867cc33b911c8ab9004c579887db8e7a2f0c6fad3c96a8af446c3bf860c6fcb721552a476b1bfa5b5c2f2b32498d3b7adce097e3932ce6fd346867136bc4baf225bed824d47b3966185e41641b8a5aa3d64c3a3a715be03530627e4d797425fcffe33b6c42bf04a6f2d5a76e9a7792883e01e58736b509b4cda179684be88be50344f8e57d57d4527d425e752c33e84604f2ece894bc1c52dfdeee1f4908d564c4da36d6687f634a79f0d0222175e7b60722b0e8af41f303cd642b7e55ca3fd91fa6b3aa97bd35ed170486b62a5cfa8aceedadeb7c37ebd22b7d0cff13d3c43827efd7b03692cf9d2a5368207d2dc512614931b1b0c510efb6b7e3c995cbba97f7cafab3326e6e271628379a2dab535497788742db98809da8908f8d02d1440cba214d157391150314ed6487cef8d1687fabadc6f6d014501b4bcff657496b8327fcfa1d701023928a623de178ee6ad9c7fb00560ddf7caf2197b9654673cfa4f27b71ede3797fc3d6c1b2565641d74f3fb7847cf678c252d7769eb103a5e1d2ed84981f8dac0bfa97917f0c28d7397b3b0434a945dbf86fcf0cef5e35d984b63c39cdc1bdb6eb6aeef5ead3bf4e2f114bd458604265242f6380e3a35b42665c3bc1930a9b76b14c91348b72f5933ab0cafb43a48682514c342ead9f6fc0aa42b9d6b8869b01deee3531da96360ba80b09a00449555ab50c1872a8dfffa0ead8da5ad9f32129766855eed06a6b654dd1012142d9b44ce786dff39b3d14c06954cce6c8f6323a4c7ccd9dddf2f319f73b10d0fa04c0e723e792d656f7ea3bd3c8e78e25ef5db9c5114c761a8400c7975497c35254eada9a8f33ef3b65e8508bf0558b37917298987dfb78304040d4eefeb06129ad848b29c43012b9131d53f9f9a46afeef98f0d31e8203a8e83e3e20bdb285682c4b73a94063ffa4ebd1e3ca5f3a132909257e4111ce10700be88f7d5b0277743e1d9deb1bcd6d426347e44a2ef587409b1f470c16050aef7e1beecba45e2148cac0a42b7eee0b9dd75b80783ef5c2e1c0fc5bd5cf8e92a3dad35806af34a6be4c42b753becd2451249f0b706de53f776cc8b8a52ffce994c954e756f1fa8a428934152d44cd806d2535ab3e6c77b4cbda96ea3afe8b66a9c6990e4a38427ad2452d1e0c77fad99df0c6b7511f2be78031978f854e3bfaf6d324b04d3411183fd6b56da87cc83040b04fbb5f8e1f927784c35902b0b76b8969103ba52269dccd132af335410e8b05321285e1a920fe779c3e998f3eb1959a880ceebb78a55130f5c0ac40ef6952fa0031a9c148baada2d83c6f0534a3a0e11dd93bbc925b3b6a36e9a12e62a98775b77eb8336fd6746458b89d61c2dd80c399a51f3489e679043613e199e48da3bcf224fcc0b929f740d576cc9fc3106e17c5ae95fcb4422a6c269cf5caa4db7df1d8b4580e42e902687c032e2241b3b7f81172ce1dbc413e9fb9d2ede708b0e08cf00cbb4392b28e94de00e562bf7959f362b8705c0968ba59525de8366f2d380519864451040efa006d470c0c42a9d470d3fc6ec25abf2f31d68c4d9c9dc0e3daf6740f88288eeb0b61002cd6fe6a989aac159d8c60b0626b2cd1aadfe2a453a89d2a7a8f710931d3004e766f02dfeb7df84c0ac1f2791b03378362812114088c84c3dfb7a206ca418eaf86be8c6584d6fac7c9fe590b0c018db3d6fe3923df06c96e642c121e93cddcce821f29dbd9c8b68b6cb7e4d1ff22e9e3e16191d49694e1ec9e19d8f4e5699c26e7001ce7368bfa3044ba733e91238b49200d02c2b459e9a979f436c76b3491a5dd0698"}}) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101080, 0x100) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r1}) write$P9_RREADDIR(r0, &(0x7f0000000100)={0xa6, 0x29, 0x1, {0x2, [{{0x80, 0x2}, 0x3, 0xd, 0x7, './file0'}, {{0x11, 0x0, 0x7}, 0x4, 0xe, 0x7, './file0'}, {{0x10, 0x3, 0x4}, 0x0, 0x9, 0x7, './file0'}, {{0x4, 0x2, 0x2}, 0x40, 0x6, 0x7, './file0'}, {{0x40, 0x1, 0x1}, 0x0, 0x6, 0x7, './file0'}]}}, 0xa6) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0xfffffffffffffffd, 0x2) r3 = accept$alg(r0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001e00)=[{{&(0x7f0000000200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000280)=""/246, 0xf6}, {&(0x7f0000000380)=""/232, 0xe8}, {&(0x7f0000000480)=""/86, 0x56}], 0x3, &(0x7f0000000540)=""/225, 0xe1}, 0x1}, {{&(0x7f0000000640)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f0000000c40)=[{&(0x7f00000006c0)=""/75, 0x4b}, {&(0x7f0000000740)=""/63, 0x3f}, {&(0x7f0000000780)=""/246, 0xf6}, {&(0x7f0000000880)=""/152, 0x98}, {&(0x7f0000000940)=""/76, 0x4c}, {&(0x7f00000009c0)}, {&(0x7f0000000a00)=""/90, 0x5a}, {&(0x7f0000000a80)=""/119, 0x77}, {&(0x7f0000000b00)=""/166, 0xa6}, {&(0x7f0000000bc0)=""/119, 0x77}], 0xa}}, {{&(0x7f0000000d00)=@x25, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000000d80)=""/15, 0xf}, {&(0x7f0000000dc0)=""/4096, 0x1000}], 0x2}, 0x9}], 0x3, 0x40002100, &(0x7f0000001ec0)={0x0, 0x989680}) preadv(r3, &(0x7f0000002000)=[{&(0x7f0000001f00)=""/227, 0xe3}], 0x1, 0x9, 0x0) ioctl$TUNSETDEBUG(r0, 0x400454c9, &(0x7f0000002040)=0xfffffff9) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r5, 0x84, 0x21, &(0x7f0000002080)=0xb41, 0x4) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000020c0)) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000021c0)=0xffffffffffffffff, 0x4) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000002200)={0x25, 0x1ff, {0x0}, {}, 0x2, 0xfffffffffffffffe}) fstat(r3, &(0x7f0000002240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000022c0)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000023c0)=0xe8) lstat(&(0x7f0000002400)='./file0\x00', &(0x7f0000002440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = syz_clone(0x200, &(0x7f00000024c0)="5d643636c7365a7f52a0ee637993490b64dd85e8c0d2dad7e12d86fe825137c13922ea551f9f845ffb10660714281233aa768b579268e18320c77bf78a8757579495c6d4ab4d4498e0ba2551b098198b13e46f359f6a1b1f4d5d7689a0ea8745b22318460d79fd49b8633524df6f202e60cddf1206eff24c3df110d3a4dcd99997f41e79574f51c548c88eee867df4c60313b261950bf76282df9d09743edabe23dd7d367e06d487dc0b3b12976019a79290d3c517ad4906beef2914629c601eec44f62be11bdba29694b9d1d488fe528f87e2", 0xd3, &(0x7f00000025c0), &(0x7f0000002600), &(0x7f0000002640)="f7d5caefefcd8da319b7f8ac686f98683f9ae3e469d03cd4320f56965c6a2c24122228b24dfc7d6afef3ed44b9eb627017360d8881e978c687991dcc0dba5199d3ec0a05c13be605a9db7223014c3acc55759a1899ba7767faf5af5ee7c5dcafcaac0a39330de6fc974668a03059acaafe5d2270815d368e1711008ed92ccdfbc883a8ee4b207ae8aaf2077655add091ea21ccd575123d0f8121d990b41b46b6d53d665a13e93b4f7c85a7a209f525b2bc588d5d47320f69dcdfff69db3667c1a94d41bb6d91dc82ad1e5d7a5399905e64ed18d34237f3f6a7c80e88c62156ff18cb554c468a270fa5b3fe139d11b010c98c2d7192a424b7b6530ed34a6b94328eb4ecaf1c6cae4d5a491856afd9b7dc7199b2ac1ae616dc5753a40f8c087b3c0e6fdd9a9669da4666e4f82c45fdcde595911fe5d194d646647eeb40b16bdeb0b9577d4fad0dcb24f49f6d3d067086bf3631f5a4630c93c5eeac8366bc073f3af24fd64ae8d53f46dab4ba7a2593d3dd89f19f5d547401fa798e7cf25302005d0fd76bc617330197dbeb6f64c410f4035547d549ddaf9a0d31b556e4fb3d6ea36cc202f95b74948e47435bfb7a093be63a343976c11bfd6362af2f1e2d60888e93407855d83fbd97c134739530afe2b405412dfbe1bf42749b393142e98938fb79833b754accd7dd7dec7a32a00c2ed0fd6184b8816b69972fd313ccf2af18a00216c91f82664900914feb03f1c3c2e38354fcb43e0af32b42204c2b09116ec3d4d41b9249235b55b61676828cc2878111954be9d5a9003a600d7688ff0a157b2e9b4f0e0ee5f672a6826b3037dc4dfa8c5bed11097ee15423462ff5208d4a7e950021e472f0afac7ce758ecd554707fd5d634401a24a97256304b16e451b8e5ffb1a4ec59d1df00ed67d236deb57318941c60ecb090fa8831f8b77d1e15a9c7f0604d9784c4b444e9a4d958313509c31807da9cb4d3db8f84f6a142c157b80592456e6c83a71794aaca4f6078da0b87ecb5b0fab30fced4a9c2c24dc1fdaaaa38ae30791c5ca7ec67a2af86f0ba1b231c4659b08788db59ff577d2f4ee7c2030e63bb98a2bdbae61dd7751cc21862d5f89073115292cf25e091b9c63a59856b31c40f6a461a8ca14aa09aa0c4996fd2b0eca85dc93c1a021ec59e3ca3e3c19f4d66e29173fdb8a5ee5e20139aaf1bdf075c0de2b3339dadc6b555b59bcb0fdcae780b097eb7cc3c9e3b9ddeced86abc1748ad3bcb89cd070021f6e5f551917eeeb270caaaf56a10564e5d9014b1374d771f9775813017447ed9a784a1bd652c6f116b0dfa7bb4ee289f36beeea5d5e0f8e505b0a41889a3f16d0a9660706ffc13ee51c371f319b6433e70c6d6943442f731a3c2e185a1912226bda36378371a5e577cc82db4a6a9c01826865db60000f10ef70d28b669d9a2be87aac45e5d87e51f3fb4251c16229c5b52f73889cdfd3847da7cb39f201c964df6a37d4aa6f51571e64c510f2991595326e9751c0e8bac5ec0f029888f27da7ce28429fd95e956eb62f229a01a97ef99f73f49d1b3bf00d11f64fcdd95e879022b13c3b34f1ef5d17b8f48fc342efdb1b947795eaf9230aa2d491472e30e5dea67a6f03d9b3e9132daf75f26de831d76a383a77cd2a214399b4673aa30cb1dcdd75c9b292c66e9c72da65b78a3bec6e90ade60efb7f2885c23758cdbd0d8355794564b38236be01aca78a153c5068a4a59e0ead0ef44d2472f6ce71b6670e78f5555188e7a34f49b1efd94c0858ef8f55c9c58d690cb36bf432c59273dd8a17796459c077df1613fa67cd1ddfa527d7b16b8e0ce22768fc0bbf38800ac9b193d9e144ef18e5f43a6b35e24cb34cbe7e6ae6e7d89d193abc66b995b1fe4d3531ca1e8e620c64639dcd8dd4cd175f6c98a02d23f4421b22faf9cea7a05f91aee6cc845260bd5c122bc69c121b7c3b3bfef1fed2c258848af69e2cd22172114bfb777f3a0ffc9e0573f157363a0132daef78a2b4060104b2b3990a3337929fc49bcb34667691b2009f6cb0e432c501f2a3ee1710bb60833c2f6a9e0d9f92569741c9fa5aa70cb656a9366a22c58186e13d236632fb5f53bb38e5595016e5bc527812f4e317c4edef74311d962522bbcbe441f69064fdcf1538b119f2dac040368a079fe59be03ffdda2cc3da80e166578d73584eb71e776d666ef4a945b80ebbf8712762850cb3565e1842ce7a1b6f0da8a0474a983338691e76995e3c55d57f1a48911e6b5a330ea278f994e02c8a4ec79a2ff9ee721b85431ea0193b6aa17b55135c7319dcc06d16f64c10791289576416400cff3090e08fc391d6142d45a00b6939c38d31b9db995b533dc4ba87b68e6a0ed10ae8a763f18303ffcf3c8eeaa917cb429d54a67378e2cb9444e11199540fbfc181a281cf1285ac8ebd914c9215551a5245bd4fe043e86f1dc0e27231b2e6319035a02fb1098dc7a14106775587a7826a1caf4876d8e85b5bbdff2793bca05d6ca041e631893898584931d488a95a0ba9332b6c5b881316c17d16bcbed727fdaed11b08b5c0118581978e64bbc0d2e80bd0edcc890a0de919e59610b351968fc4718949d7c944d6b474e129d7f30df1c0323b72721afe4fe566854554c4e41e1e87781daef2e54e8c18bdb6a1b82bf3f061bd882f7fbadbcde8e092793cb09159653135bc78c63ecc2b32d42d21455b3f15e534db5bc5b5de9950dbb40af2411260a66c664242f1153c11ffc980ace870ed7f5c35317f57d1071ea9279ac63bbf84a877917d378a6bf3d6900865d862208eddc4bd95aea7b7faf8cd4b841437ecaada38367e70ba809fe23e7da92210418cd3a5a3b260b401b283e166de3a6b887b2151fc1fd32b92ee5dc3b35ee106c3fe6242759e3a1cdb1d5b247876c07ac709c6678bc62610b653d3ae0e78d18294ab9771b1fc3a344b132e7f91df2705d36b34a9057e636e000f91e898c64679a7896f68ce08e6eb0be730ad0e29e9ae66cdf150bb3324f12ab5b6cbdf6c64d9ba0eb765f7dbc6cfcf6d7f153425107aab1ee92afe9e74542185f7ac9afa64231656189783c4bb94b8e78a307ccd688ff3625e4e5351e513e2346ecff60c9c00bc6c93a50eef3be7d131c650b763b096c6e2f8f4af53d198934bb899fe3af749559c45158e97b957f38e7d2df41ea5e561512fce44712784cbd53098d8a4cdd7b51e64b5d191d1be8f4b27a8bcd7a8032b3a2437a726b650834e317e8a7e997d08dd1194caeedb776083ffe727c31eb298667031650b4ab8da6c69ed49dd9112b07459b6bb643543e198d60550e4ba61c834db488b3fc3eb85418a74074951912272a3ab71edc9bf1c0f3725a53913b329f97f90e1f6a13f343dcbc956582592d1922a5ce8ce59f66e31726592f75a13bac5077d36095158675dc22ad6070d2c4b98db7224fc879e49c7a6ab0e218a2894afaff050d8ab70199a0162238acf38b22ee4c0595191da7a7789c394da1aba98248a42a7f42dc7f08ee86818d357a108847b28745a2faf8173de31d6aecc50ae86c2019e54d6857326529a5f3979e50b4695fb1a1a37061e1cb0f4a3cae5d0485b7adaf82482e6ea913ae12959c028f09a866969268e8757a1e7690940ba5901a154b3120269477b3713f84d00353f31763b2dc713b302b3d339a5715e057dcd9abc80252c2ec5e3d3c753ae83050bfe9bea8efaebf3c59e0932e14231b4da0c43d4afcb55196cad79c2ea84964fd7a18c4bf52f2c137c5c8f62343016c2ecaca7f9b6230eef005a31ef80ee7479eecf4246b969604dac6b85cd63fa0d1ce0977031e0e0985a879deba03f7154ab21b1f4087e0947c3a7574a470f8c1d292606b38f90038e42cc802133592ff9b3c4b94f9a722e6eb3fd256f941c8d294e02bfe1af69c6f8be51258920792c3ad1e2b6b72e55d659e98f7d0d66df67c7c96d575984e94d0f3e193a7ceca6f14fdb923cdc0089ca340c5418a0f1e254d9e0870be99f25bd4abf11d3004bd593f09a0ff556c6e34adb5a6cd5f8651816f2e5969051348faeee987ed7f47c124a3f35ba8c22408e11f6dabe110b8c843b5696203622d391b5b13c7703df77bd5febbecdb72de8af8e96dc79e0ad50eabd9348e84e21bda10079d4fde8b66cac11c1398360f65ea52a5852d0a920474065a8e64223aa8ac1f92d5bc2fde609c4bd5bae3f633b2bb3deaa477686c51155788507c51b3184fa64aa76f7e51303ad67b1a00ab82100786e5d74a10e0296d6407a1d6e99c0ccc08b8fb72b4af79a7a239a5599ab9b53d4664e86f818dc242e9ab663668266a78f3e71ca03297e6f9a5a26f07b9c3c29ee4aeed9a880c43081811bfa63c6c72ea87df7fbfce301190ac5ac8af91b8712038fecfa4095a132128450413896c75855482150cd932892b45190e7e0dd265c5e99d5e4a69b98e91fed300f7e16070d38a294ddc55f4bfcb5edfb7f86cabc9c4cb834389418eb38810e1a44c06f1bd10ab1f7ee47a104a5adeae2c28a5e795f74b4b37c98d1125bedfa174ef71e1d7683d1591e36b47083e5d37aa4d4de0e2985adecf2e9cc20d74c067225ba8347eae718e816f4f059bf95fbc85cb9515726b4168816c377475743c42a9e4ca2b1e723774d5ddee2ed83854aca58dca0d08a2630c92c22a1086b8487307aed19dd7c346cc0d624e3c90b957335d8255a9ad4a0c6f229214d708dfba7735d072f2bdc2d6c8dbb69d9b41d608b34e0b3b351494d1731e5216c872d963413bf3adabae0d90c3e4e1fc9b62a6e5d564307efb51d2eaf31b0cdcafa07fa8c1afe3f4a521fa95dc7ff2f23883fea5fb8c24c5a1680c77cbef8f676413e419fde828b7059e2599777561b9454c0dc81982a3a1725ff2bd60c54b440062cbca0d08952db82f90e635d22548d4d24962d2fd1cb295eab888aac073f4230f4bf4c69aadb07b1afdf36da5406c943de3737b53fecd87be7698de551f79241347d3944a0aaeb0f08372dfb85ff89e3e37904fdbdff430167018bda1e06ff2a2df92e210c8c772b9273538c8c2a08aacd18d0256fee2835915aeeb4375cf9f52e742a8b0af366ef85495b4dea0e44511de5ad577e15383f943a7ae13eb97c709a6dda98a37a747021c4ccde5d2018f701412089ad5ad63e9f4727833656ebedd4b514c0bcc56e97445ba07934da4c3a8452218c969a7b64405a9837708fe36409c0f65a2c991378cefebf68bbec078f4c03fe1ac79e02825d724681b7ebccd677453cd2c0b0f16f8b374d36d9e7ecd2ca7e4d98c1568927d192e45803cded766d01d63cade7c226975e2d5871568b4ee6e2aabbe06597940e68137f6e6cf201c4dc418c75aef8a97699617c3d030c37ff2f600bceff144a83ccea9a845711d5d1ed8043f4cc1cb995385aaa00c277831ff163c305ea9a90b140605676485aeff6c39b05eff326032caa32f5a937b6b99b1a4c77345c5a9da3abc172016145ab94d2104ba420c71f530b87d8b02196fff5d5283375445b0ea6528df8f0fe38748b9871ab76c72842630c07fdb82a1ff78357fafcf6176033480b5dc99a825aca363bd58e83c5b64791ace843a14a4400c49505d71ddfea5cc5d620948a186325158017bd559258e36b59b084a17191e744c49b7fdab0761e9e2a68fe04a4e1e4dd46994bc80bb8a8d13f5ae37727462d50ccca9888f80e42fe040d265ee7a7b99076b13d4760bf89fd95df798b02b1b2de46646bb69cd4f7d55ca5c6207d0938e4afffe96eaa821d48f71a1cff11a4467bff1d621f2e2ac8421fd") stat(&(0x7f0000003640)='./file0\x00', &(0x7f0000003680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r0, &(0x7f00000037c0)={&(0x7f0000002100)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f0000002180), 0x0, &(0x7f0000003700)=[@rights={{0x24, 0x1, 0x1, [r0, r3, r6, r5, r2]}}, @cred={{0x1c, 0x1, 0x2, {r7, 0xee00, r8}}}, @cred={{0x1c, 0x1, 0x2, {0x0, r9, r10}}}, @cred={{0x1c, 0x1, 0x2, {r11, 0xee01, r13}}}], 0x88, 0x20000040}, 0x84) r14 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000003800)='./cgroup/syz1\x00', 0x200002, 0x0) r15 = openat$cgroup(r14, &(0x7f0000003840)='syz0\x00', 0x200002, 0x0) r16 = syz_open_dev$evdev(&(0x7f0000003880), 0x9, 0x100) ioctl$EVIOCGMASK(r16, 0x80104592, &(0x7f0000003980)={0x15, 0xab, &(0x7f00000038c0)="21f3e7badd2f5e05d06f57c934947c7eed368bfd39353a3bbf54a820c9e16fd1dbade6e9f2da95192400c1192a48dc4a31f74764609c5082bc0e83a82ece6db9d6f769c699558453957ba7a3e93add840ef76470ec32fe6437ff8f36966cb636a8b5fee4716e7319c70cd41ad7cc9025666f3cd8e9178cb49e31cfc3417975547e929080b29352cb80c503f12838fbe1d4fd3a73238c14fe7d263a03d4f1ddadc880158423bbb49e144b21"}) lseek(r15, 0x400, 0x4) mount(&(0x7f00000039c0)=@sg0, &(0x7f0000003a00)='./file1\x00', &(0x7f0000003a40)='vxfs\x00', 0x100000, &(0x7f0000003a80)='\xf6.q]*/f&{{$%/&\x00') getpeername$inet6(r5, &(0x7f0000003ac0), &(0x7f0000003b00)=0x1c) ioctl$vim2m_VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000003b40)=@mmap={0x1e6a, 0x2, 0x4, 0x0, 0x7fff, {0x0, 0xea60}, {0x1, 0x8, 0x6d, 0x94, 0xb, 0x9, "c73e54be"}, 0x400, 0x1, {}, 0x3465ce42}) socket$inet6(0xa, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000003dc0)={&(0x7f0000003bc0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000003d80)={&(0x7f0000003c00)=@migrate={0x148, 0x21, 0x0, 0x70bd2b, 0x25dfdbff, {{@in6=@empty, @in=@broadcast, 0x4e23, 0x7, 0x4e24, 0x4ca5, 0x2, 0x80, 0x80, 0x33, r4, r12}, 0x6e6bb2}, [@coaddr={0x14, 0xe, @in6=@empty}, @algo_auth_trunc={0xe4, 0x14, {{'tgr160-generic\x00'}, 0x4c0, 0x180, "b1f88fa1b85a481db57203a00a0919d36f886aae9331f0fc01d039bcaf9456020f2dae71d1e43f29a15d075c9ff128d7fc707181ad947f016a9f0e9f1d27daa4402dbfc67e163938456887dcb97930bd02d4d5d40d92e45e8c92406492bed6074444d01940d09c67430d070d82ff50a1c51141575e032eca82d9453dbb10288e5a9af50bbd35809621a850c1a3ac0bef129a7af0259b5ec5"}}]}, 0x148}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000003f40)={0x0, 0xf5, 0x1000}, &(0x7f0000003f80)={'enc=', 'oaep', ' hash=', {'blake2s-160-arm\x00'}}, &(0x7f0000004000)="eb76faa01ec2b9c2055cc4e29c1385a5ab8e83239ce1da920c7b0fcf993f9d6fdd7588c11126949b309bdb5c4a494003239aa6a4e20e256969f2a2861a8d8b73e54eef0fb9cc821ae32351a0692a9228a4d59f816ce05c4fdd7328c2029338a8aa679ad337dab2f05f7162dfb0bcc22ff5bd09131d99e80709021b98d9ddfc13392e72b43b196c4342ba15b2ce1fdb1d2653a55126b73efc49830bf20ffb642098820ac0e480ac379933dd0fccf0227c076415111b2f8d955593a6e1cdfad0f92ad84cccf6fa724469e013962dbab34ba6a78c6b8afaf771a55e33c5434c8c67afdc474138ca11676b2b1c35f1dbf7e8c95853c3d5", &(0x7f0000004100)="c2bede02527022073203218917969a7bf330dc5da3730f80c6cfb624427cc91661f7849cde0d840652400e848d3cf07aaf3456b30fc6ff64edf3afc10679ae7054aacb985e1e1e1411b57f0531744f89fc27c8aacb5e5ea4b4b5ea5753c7d3909ce273f3667a6ce987a7046a044525990aed9cb61c9c894365dfe831f5df2b73930c7c51f24a36b355911cce39653136a1af0fd79a42891a513c84ec27b76eae6637d80ac1b3964e834b4cafac936da023668bdaeebdb2c59a9e8f2641b2e5a7fd31c9e4e3c872babbd60f14e6fdb60e08ea80fef9a6049bcf195f910c9c6bca18abdf06214bb3934222aaadec4ff8f865df1a9272131579e704e6780400565e2544b2a81a9cf61cc786293351a12af4ca4f186df970a337caa68bbc17f10e58e4a5baaba75f5643523608d8d625b5dcac6e12db4ea38d5c71f88ee645ca57b0e94b74391b57d7fd6e9313390904316235828db351b7bcf1449ecb4666efb8eb0f57bb0e0bd953491bae5609190c89d9ec60c40f06eb2017780acba14bdfd731151abc35f6b90c66b9eea1f958897b5c0f6f68c79b324e5a4efb35fedc5fcf9a284435296526b66f68404c3db8aad151d1b8d8413553db3a2423cdb88f08e34a144b288e6d26665d2d3572c701f3a24518601179a0a6f86878c4ea2caece04c010238259dcf5ba3dc941ce9aaa79e0ae842d5dae26fd68d9e7e773d1652a4b427c70d22a8ed634adfbf1c5caf9b038f09103537e983c19fe81dc984562de367f887031e667ca69cd0f177382b68a357838f83be7655babfcebdfa193d3ce965b3ae0335528da0b3c39b83ac7b15631c3db058165141240a156c157e83655a3f3201485df2374bfeef56628e2dd006aab1cebb55e811b591a19d1d39985e223ebd071fda21d8bf27258878e59de3c5986666bceccfbf51df95968afa87307f9cf06db08c7e5b9465f0fcd0166722ce8cbc2f1ee0088c3cb6a2453979f058b3b6e3444ab3fbca13c62e2288dd2feb5a1ee38b002452bf66acc3d156767a72d67365295b204c4d7594dfa94922492df04a66f20fa1d9c650f0b7a4d2ef652192746e55c381f61bd4cec2534961f65d3cb6fa9074ac1e8419cce4c8a18067cde5736225be737470bf6d4d590f17e4219ed3e6a086e2a8c6c6539e76fa8801e22544e2317ff5d3318eeed1e968d8ee2ccc7fb3a5573a5683d53f2401f313ec708b457078eae9c010a2f07287ff4a989604a6d4339827e4fc7ab8a95802240d4eb584f51d7965cbed75fac5022aaa9be3bbfd05ae24c4c46aae7636ae66dd32335ec42d2daa4ea24d3f28c8d6da2b9ada5692f52938e597fa2aa8bfeda1367552a17f8227d00f9dadb0de6197b5cb1ac8f6527cff854b12adcb9b56caec9d9b1d6e7b708f5e5f8fe375d24bade0fc0f0228976a5ba5d4d371231a7492f926f83617a2deaa44a604352d5784cc68be6a0246af8febe9e6d723df7700ff3ed2627481ee0bbd196b8e84f9ec904be521afa1f24709634d588dd40736e99bfbd9f4c47d9fd61ec624a1f46aa2f7bb50952f9fed0d97c81c6255b9bf2d6d49267f3b92e0f436c0d80017c9deb4fe405ea2aeffff8465a5b0d46d91a09b1e4c0c55788c0e0d2de7420ea49b994bba10802d9cb096391478cbefcb869d44a8cf2b57e785496f9b08d37752652e6201ca5ad1e2954f9c848543fb9fd6475484ee456d80f50998a44d773b2cd3e90a0f127bdf068c0d634e3d7dc811534f526b8ec14e294cf7a3598cc9b713c1d4f113cfb07a7160a5d4d22d7c1e1ed1c31b68c6a8683c7eaf29051ad8242077e7141754a96059c6c2d3c1fd8a5d2240ebcf9cbe4669172db929e3da9fd5b0fafa0da999dc5ebdbc9365690bd16c1af521bdbde6b26fa476156760649389960378e6e032ce44f7f51ed481d5c0affb02f52247da9ab5b6b2044b636b4a028e2a788180a6bb1ccc6859db84bb7ce6842196c37dafd0c670946351aa141925452d0efde41d53e077075fe4bdb4c9ead56aef37b2a4a8920fb205887a947eaf214a757f3e01a81974a3f50d14f2333a0b27a4427404de37526deac0157f6f141c42c6c9dc8438ee0395abeddc4c756c27978c82620146891dcc10f270b7a349a5874e146496296d21d53a0d518e518e21b2480baf8aace2add034d3027c7c1e5b5e0a9be242e233329311a4424e00701e4b20a701c88b2ec30b4644fba1fd27fae31f5d57527951220d7036197925b2838c8640d88637676c1c2803f4b76b615f80c76d5b9ee2b161cd1d7fc31639670ab92dfd79d969c67b1f97fd8ed68bc4e5285a89feb098f4b7fd6194374d4221265da18970bf791d914e465588ae16fb6b7e1e370f62c1706862db7cc4e76ca7095c63f889dff758b4f4a725f383e97bef401de6e31349d821fccf9d5086f6d458e077d2b85480d3ac55a82bddecf25b03e9dc9292c2a78d2751f24065c643dca5bcddd505d8d9a16a01a2d9c51e4b19f7c0e346a2f23ed339b405257b4ca76ec042cbe6e38fee10e27b44d5163505a3f3402459d5fa6c8f87fd6cc96846680be4a2a28f8a37a073384c2bc5e1c9793d43f7552fc97d9791aac06e8482796a0e7b3a458adc2890929e29a0d9b2d3304974587daa108900b8d811f0fa3160d58a33229c2033f4071f3010f6129a9b3a69eee1dd35422349b38d4de369fb1923ae15c0e7f7383529a0127127557ed713031c206b5b135d1e36ca34b3bf616a1a21e09d2bcc1dc1c265e67dda3be15870f2aa7233442b5814ef4dd3c9390bb423e47ee46265b18dc9009a364822f89a8974fed161f88963714d4bf6212ce74ad3768caaad5a32639918119aa3ac648efb98f9a4bab1f269c950b8b9e6508e8f091084e6f8a5eb5b844e954f3c7fb9e9fbc8a945b209f88b9962c4d78859c7596f10cba792985eb431befd62bd7238c75a744ebb7c8f13b315b408d429f8026735a0d4d089c7310ff6a55dbbc2ef4c25c31f95c94eaa210585b277d83702581461520bbc641d24bd7bae890ce4f366ad7f20e83dce8e73263749a241b538509b0b48b50f88eefddd420cbec392ef1be8411e91252e4f49b1965bad92a730de9489968fa27133d15ab48a52e248b866cccb79b2a80a876b00833432f3fd9d421acf7bbbc86fbd1d851e900ee5c1580f8789090cd96e51164a8280fdfbda7f604acbbfd2a06ae2a80281129b924bb9db0e463ef49ad1accd03d3f18aed177883c125f4e55d9d4491e9b28e456fefe9d477faf85092cdebb93523b63b54ec8cf6b0be54a911186a5e796f45b86d035636b9a472faa84a256b06315900ffa323487ca3f0312c907257ed647fb5bbadef165d713d61b8173cb96fe3305952e13e3bf394935261b0223a0f16683dbcad4d376db854a220063a07814cf3abf5c64d39dea963d38acd48c613a96f85de07a701d9c85f401a2f425c856efcdd2d58156885f6cc58d6bffa67ea5424755e6c6a140ede0dfefd4c81ccd2039c9c43ec7a193c56feac5ed83e7b622fb345291688388c84ae5d990db1d05738abede24fbc6123359ed9e4d0a6964feaa4f215514956834de7d04dfb8e3fc6394b474f41bd13e53036dc2056ff7e8f79ca7f5528f8d104c3c0771891b89cb6d900621e98eb9df85c79dcc2f88f698235bdfc7387d5277035bd361b19a1ddcfc6ab4be999faa11a30311d98028c88f41e52f3b49c17a23405ada4fbde82ec214e1d39ac0c3c6e1f7df6146a6e02884dbe787f95d2ab2837bc3dd9046ba8bdd361db4fb61664a6a67e83fc34c864fe39404a5669780f149452f81f4009d0fbdbc7a233afd61a0e377a9d2fd9d15052533accb8901ca44b2b959c85a780d10fed9ccbfcbc50c47e7560d9ba531a713f38808c9981375317986d3f3c6aed4b64a2abc2050a61671343c539bde6780b8f2263f76f70d15ba4a241c6c3f8341a582c9b9837a9562fddd029dd8a4181dcd8f4409c3d8ff7a889df5ee2eed6a7b1fff1c3acce7cf27b13a0808f98e6c5bf4dab56d7e623669873270159434b241ec9ec0333b9c6f2f82ff320185d90fdc1a46ee2524d879364f8e75924cbff44cf806cf5a9300b3d2fd8c838fb0b3230707caebf937d1985e0a46907de98e2562737bbf3e9dd5c12c95be68c655ef17eca221d292a38531c4d1e5b19693c466a336b3f92413a098cb07bc8949414afc261ce505b8d6de18eec678f64ec5547068ac03583842f99de4897dfcef7fe35d9cae01655da88aa09882236da0309c09d11f28c2c3c826fde7131c10c40c9f9a3a36f0e1221a00ca16340eba31543ed28d480ee1f3114c79639d1ab6eaaad83e2abf4ac4100e694036a2ebbde18dad6d34ebedc80ecd02a0a10e4d0ddfb41b71523241fa518c5d4f53af7984ede18a698a616864734ca35efd7cbb8b5db4e13e1ba5eb48105590b00497b7ddb0056591f2d87edaa29918f44b74a292e254522eeb35efa27750e58f40e24ac98b003acfacd2745af11b215f523e900d2e4918161bfa96d69e06d55314a498193b28078935c99e8c86513c24dbd674e8c36f13ec2f32779829605c6112ef48176398ff332ae930c7d85297a1dfcfbd5858956b3499ed87eae0329f234f680441d97fc69de979e51f1a5809f0ea02e90bad647c2258b5b32c672960a6ef30584c91b80d3daaf8f36b055d17626bfaabb88c2ef153d7b27cbaac7c1216bd1657737e4423e64e29991684dcd375881ef9f95987be54812774f692a7e177d21b952100a662f0279d5cfe1ba13274c188eccc20cc490a227d87a7db6a59b81947a0d8f79c3823e39d6ea4cc8aeaf3aee29a54b6541d825e821d879e7b99937ce86a91c0cfbfcd4dea52296e5e1f0d417aea53c31a6d95c38787e2d853528be784aea6a262fb5903babac9123b7604d613d69a9f1437e3a37bb7c3b05fcb73736a4b0734826460e43602d12b2a132e5f9e73d8c717bc063af5d42affa9ebf5ac26603a41e6bacea714acc688b6f4cbb80dd0cb97c997b3400a4b78c39f89cec2cfb47f9e71cb1f580bafd83f08c12caeacbaa28ddbb5335990fdac41e3750528e3f0fa7de09e5a00db0bb5fda619f79f3b1246f361a2bf94508ef6bf0e7c6cf7ab8b9929f5908f73a9ea37beb8a4c88aef2b592da0409c27177e7f181c6c49a8d0421d215e9fd753305f7ab827e3bc5633fd8a82cfdb62e32d627fb335cb21969aa07be163c1526e4b4a2b55a01c3ba2c9f54a45dc4011008fe5a3b6ccae73bcbaffd8354d84f8f72becfb2f7bb24f07a3100b5a84a116feee03ca1ea3ec7b9c8df1869f04a62abb22565a5dc95316e715fc2d5c87b14f95d4d87a2111ba5311aa68fed801e668d9af4fc54520093d333c348e8459fdd6c83eeb4bcd5d09086f51270cf39e52cc7cdf97d2c9ffc365a437b877efb25dfa52d0a3d8399b69d41bf7c31d3a8d0ee01d8957d6fed88455d5e63c498fe914384788c5ece79cc9695fa47decc6baff8b397a6fa84fc8ff666ee1b638fea517e94527d552601e5f94f9e33bbd123bddeb941b8283dc307ed7435488ce4c12b27789cfeb0cf7cb3ea1d2aea67ccfa5b6298b7c44e65b87ab533f8f93fa03a0b7427ae241dcd23618ee5737ebf6f0a7cd67af5d8d0045e94070fba9871fa57e57a6757ed2c8658834cc97a87b07a893a784b46c93cf5509969a5d36e2a7dbbd8704acd9aaf4d5f75ccfff52a7bdfd1c55ff39e7fd47d9411efbcefcfd2b194697aaf06092281997abf1c2e2e2d6f17fb300918308fd864362df1c46ebc7212b81f64834a24831947336cfef") executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x80000) sendmmsg$alg(r4, &(0x7f0000000040), 0x0, 0x40800) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0300000004000000040000000a00000000", @ANYRES32=0x0, @ANYBLOB="0400"/18, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000857d92b7d54277093c2b692213bc53f9d14192f757add8c6b9a8a1b74fbbdc4c198f156693672535624cc075eb0046244131a15d31"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000fffff0000000b703000000000000850000000c000000b700000000000000851000000300000018000000000000000000000000000000950000000000000095000000"], &(0x7f0000000000)='GPL\x00'}, 0x94) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x1802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = dup(r5) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0x2, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r6, &(0x7f0000000540)={&(0x7f0000000000)={0xa, 0x4e24, 0x8004, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}, 0x47, &(0x7f0000000440)=[{&(0x7f0000000040)="f0", 0x1}], 0x1}, 0x40054) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000001380)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0xabb8, 0x67, 0xa4f, 0x0, 0x28, 0xffffff85, 0xa9}, 0x9c) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) epoll_create1(0x80000) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x5, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) socket(0x2, 0x805, 0x0) executing program 0: preadv2(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x4, 0x11) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="07010100ffd9f810f80600b0f97d0102030109022c0401000000020904000001ff615a00090588"], 0x0) ioctl$SNDCTL_DSP_SETDUPLEX(0xffffffffffffffff, 0x5016, 0x0) unshare(0x6020400) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000240)={'raw\x00', 0x0, [0x8, 0x3, 0xfd, 0xe, 0x5]}, &(0x7f0000000000)=0x54) keyctl$restrict_keyring(0xa, 0x0, &(0x7f0000000080)='asymmetric\x00', 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, 0x0, &(0x7f0000000040)) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000140)={'nat\x00', 0x2, [{}, {}]}, 0x48) executing program 1: timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x2, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = timerfd_create(0x0, 0x80000) read(r0, &(0x7f0000000080)=""/149, 0x95) ioctl$TFD_IOC_SET_TICKS(r0, 0x40085400, &(0x7f0000000040)=0x8004) executing program 5: mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x9d) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x50) epoll_create1(0x0) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}]}) mbind(&(0x7f0000c9c000/0x3000)=nil, 0x3000, 0x4003, &(0x7f0000000000)=0x100000000000002, 0x9, 0x0) openat$dir(0xffffff9c, &(0x7f0000000340)='./file0/file1\x00', 0x40, 0x2e) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x118, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0xe8, 0x2, {{0x7, [0xa, 0x3, 0x8, 0x10, 0x4, 0x6, 0x6, 0x0, 0xa, 0xd, 0x10, 0xc, 0xc, 0x4, 0x8, 0x1], 0x1, [0x8, 0x4761, 0x570, 0x1, 0xffff, 0xd729, 0xff, 0xc, 0x5, 0x3, 0x0, 0x6, 0x2, 0x4afa, 0x9, 0x1], [0x2, 0x2, 0x6, 0x4787, 0x5, 0x7ff, 0x6, 0x4, 0x5, 0x6, 0x5, 0xd35, 0x8, 0x1, 0x1, 0x758]}, [@TCA_MQPRIO_MODE={0x6}, @TCA_MQPRIO_SHAPER={0x6}, @TCA_MQPRIO_MIN_RATE64={0x28, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x5}, {0xc, 0x3, 0x9b6}, {0xc, 0x3, 0x5}]}, @TCA_MQPRIO_MIN_RATE64={0x58, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x3}, {0xc, 0x3, 0x8000}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x80000000}, {0xc}, {0xc, 0x3, 0x7}, {0xc, 0x3, 0xa3}]}]}}}]}, 0x118}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000023c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) r3 = socket(0x28, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) unshare(0x68040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$pidfd(0xffffffffffffff9c, 0x0, 0x100, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r4, 0x0, 0x80, &(0x7f0000000880)={'broute\x00', 0x0, 0x0, 0x0, [0x9, 0x2, 0xff7fb532, 0x3a8e5b6c, 0x40000, 0x208]}, &(0x7f0000000000)=0x78) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) timer_create(0x2, &(0x7f0000000480)={0x0, 0xb, 0x1, @thr={&(0x7f0000000280)="e33a5f3a3f8a7a551b9d7ed3722597b754282adb927f280e107632655feb6f43feb8a14ea1d977c126ef5dd209cbf761c9f10fe2a474978f7eb917513073228bede0d58b601e1290cae603618c5e3687e5294b584704b8c086a44c6e3e34a5eadec4b6bc1a4aeff7c61390b3016bd43303d297a82ee8a350e7eda2cfa6c648cefa1d1a47a6211e455c424d40667ad4cf9e9f571c1a1d9583f5e19e870ea84f54ed30ec53272ba9f6a9693be8b3c4ce2b488e0ecb82afe822a165dbaa07df8f30b84c29a133a483fd9b26bcd86d424ef1747679d0656f024d90b9c3d9347f275e99151f", &(0x7f00000003c0)="cfa896edc444743d6051d773dc8eb88dd4375ff4e2748d6c6972ea9f0ccc124f678427e25322fa7fb8cf51cc9865c741ad18143c0094c840376514c82a18a01e5d06f51ed90856c40103370b6f5265f812d6267304303bc3e6939ddde7c066d0ca2b03362c44052846a7a72193c7f5e657717ca5a71dbb6d5a0567073ee7b024d44017a80308cb6de843e0925d927419b00237174aff0b842f7c5ea2e77285"}}, &(0x7f00000004c0)) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000100), r3) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000500)={'gretap0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x10, 0x20, 0xa, 0x10000, {{0x15, 0x4, 0x1, 0x1, 0x54, 0x64, 0x0, 0x7, 0x2f, 0x0, @private=0xa010100, @rand_addr=0x64010100, {[@ssrr={0x89, 0xb, 0x15, [@empty, @empty]}, @rr={0x7, 0xb, 0x1a, [@broadcast, @private=0xa010100]}, @ssrr={0x89, 0xf, 0x15, [@local, @loopback, @multicast1]}, @ssrr={0x89, 0x17, 0xc8, [@broadcast, @remote, @rand_addr=0x64010101, @rand_addr=0x64010101, @remote]}, @ra={0x94, 0x4}]}}}}}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000e40)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000e00)={&(0x7f0000000900)={0x4d4, r5, 0x100, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x228, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2f7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x10000}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x244, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r2}}, {0x8}}}, {0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x1, 0x1, 0x12, 0x1854}, {0x6, 0x6, 0x6, 0x1}, {0x7fff, 0x0, 0x6, 0x2}, {0xb5, 0x10, 0xe5, 0x200}, {0x0, 0x0, 0x2, 0x4}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7d}}, {0x8}}}, {0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x5084, 0x3, 0x6, 0x6}, {0x8, 0x5, 0xff, 0x1}, {0x100, 0x1, 0x2, 0xfffffffc}, {0x81, 0xe1, 0x80, 0x7}, {0x0, 0xf, 0x9, 0x4}, {0x6, 0x40, 0x6, 0x1}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xb}}}]}}, {{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}]}, 0x4d4}, 0x1, 0x0, 0x0, 0x20008904}, 0x40000) executing program 2: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000001000010029bd"], 0x44}, 0x1, 0x0, 0x0, 0x404c8e0}, 0xc094) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0x16f, @tick=0x7, 0x0, {}, 0x0, 0x0, 0x5}) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$tun(0xffffffffffffff9c, 0x0, 0x100, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r2}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r2, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) dup2(r0, r1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000000308010300000000000000000500000634000480080006400000009008000840000000050800084000000200080001400000000b0800074000000005"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4040884) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f00003d9000/0x2000)=nil, 0x2000, 0xc, 0x50, r4, 0x88cbb000) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r5, 0x4068aea3, &(0x7f0000000140)) timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x2}, 0x0) mprotect(&(0x7f000000c000/0x2000)=nil, 0x2000, 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = request_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='\xff\xff\xee\v#\xd9@Y\xa31\x0f\xf6\xb8xO7\xf2\x95\xe5\x8b\\\xf50,U\xaf0\xa0p\x15\xd4\xb3?\x1cD\xb1\xebb;\xb6\x8b&\xc1\x01A)\xd6s\xd7\xdfl\xa6g\xdd\xd5\xdf\x80\x95g\xdb5\x81\xc5\xa1\x8c\xebG+3X\x80\x9e\xfb\xca>\xaa\xd3\x96UWQ\xa8\xae\x89\x8fPqh\xca\x90.G\r7\n\xab\xfc(m\x9c\xd8<[e\xc6\x83\xcf\xf07vw\xfd\xc2\xf4\x93_\x9b\xc2\xb4\t*\v\xf1\xb7\x87\x9aR\xe7q\xc9\x17\xdf\x19\xe0G\xb4\x96\xc6X\xb54\xc1\x1b\x8c/\x13)*\"\xae\xcf\xac\x06@\xb0\x93\x94i\xc5+V\n\x12-.\xf0\x9e@M*L\rd4p_=\xbf\xb6Ml\xbd\xfe*\x96\a(\x01\\\x15h\xec^>\x1dq\xb8\x89\xe7J\xb0\xda\x1b\xb0\xc3nlL\xeaSYs\x8e]\xe3p1\xc1\x16\a\xb7ouS\x8eY\x90\xab\xf8f\v\xaf\xdb\v\xaa\xbe(\r\xdf/\xd3\xff\r+\f@\xb10\x8c\xc2O-N\xee\x05Q&\xa5m1+!\xfdQ[)\x1f\x14vJSY\x82B\xa0S\xbaTjy\xb4\xe7\x8bU\xb7\x16\x95\xcaI\x9e<\xa9\x18\x00\x00\x00', 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000340)={r6}, &(0x7f0000000380)=""/111, 0x6f, &(0x7f0000000440)={0x0, &(0x7f0000000400)="8526e6e73c1a2f48eea4a209a5e3389a6db220d74add41c510f329", 0x1b}) r7 = socket$inet6(0x10, 0x2, 0x0) write(r7, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@o_path={&(0x7f0000000040)='./file0\x00', r1, 0x4000, r0}, 0x18) (async) listen(r1, 0x30f5) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xc5, 0xca, &(0x7f0000000100)="d186008de55fe3189ce03ef8200d47bb87045420cccdbaf3033ca0a12daa1fa1e0d676e91fcaece8abcf115cd830316aa4cd65c25b0cef7b25e031708c54a0e79f8fb639e0b44e0842d69f253d494e3166951e8eb54b51108d9c0297412c8e4b0eba1d22233ddbc7d1c74f3e4d411e03909e69e00618df9a275daf6789f24d1796fa5de462f391475a81c6717c83635c37bfe7d429715a78247054f516fff89e8c7973cf97730f2138382ec76491d97c7d3f72d7ad7c6fe1828dfd8f03c0d261678525ad44", &(0x7f0000000200)=""/202, 0xdad, 0x0, 0x60, 0x2f, &(0x7f0000000300)="e5c808474c90ffc6414344ec203459b199f4230a27ad4503bafdd6954393e59eb7542cf453dc611a2d93927e9855027549429aca7367830f4115f7265da7820fb6b9f6ad5e289d0d047d959338a18c1c5028bb3f0a1367ee31e8606b7580aa62", &(0x7f0000000380)="f939e68afee3e49ebe058c61b554a1a03025ac81080fe319699249b0d2b53a4d6035249197f46c1d2cbecd9154d235", 0x1, 0x0, 0xe7c3}, 0x50) (async, rerun: 64) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000440)='\x00', 0x0, r1) (async) ioctl$HIDIOCGFEATURE(r1, 0xc0404807, &(0x7f0000000480)={0x2, "b5b06d98ba84feb13f96a55e2f74a7f891eaf716551cc61760ab814b4ad1ee87ed805736d7354ab5c3b2658438e14dbec4fdc22a27b61bd23a0193c45f8c4721"}) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000500)) (async) ioctl$BTRFS_IOC_QUOTA_RESCAN(r2, 0x4040942c, &(0x7f0000000540)={0x0, 0x4, [0x1246, 0x949d, 0x2, 0xf7, 0x1, 0x10001]}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r1, 0xc0245720, &(0x7f0000000580)={0x1}) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000600)={'syztnl1\x00', &(0x7f00000005c0)={'gretap0\x00', 0x0, 0x40, 0x700, 0x1, 0x1000, {{0x8, 0x4, 0x2, 0x2, 0x20, 0x67, 0x0, 0x4, 0x2f, 0x0, @remote, @local, {[@timestamp={0x44, 0xc, 0xba, 0x0, 0x0, [0x0, 0x65]}]}}}}}) (rerun: 32) setsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000640)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, r3}, 0x14) (async) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000680)='bridge_slave_0\x00', 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r1, 0x0, 0x62, 0x4e, &(0x7f00000006c0)="808d9565bca0fc5b9dd67ce0f38f950ac68647364926e2b9c8afa2d70f97598b0baa10bd33fea9fc99f410f38487c97fb79fca15a1c44f13cb39c4f4e0dbf687a405ace61be82b9cec5f1401cec7792e94181a58f6eddc6ad6d38508f8547541d963", &(0x7f0000000740)=""/78, 0x1000, 0x0, 0xa2, 0xc7, &(0x7f00000007c0)="7bd173f2a6812d55ae9ed197af2c5db47bba560e2352d64aa913635a4f0f1ef9b748ad3d186ab2456af3b97adb2fe0065aec45e0c16c21e81a5cc12926e8dd4121a44ca452605575529bdf75a04ce358845d47b229f652a34a872a92706db1a186bd2800f8afc37c8e992366084c94ec7a40df72dbdce0f985400657e9c73b94418b05cbcdb0a3fceaaef3f23c4823f7319462e1cf28e38b37d6f6602bf862673ef2", &(0x7f0000000880)="e3c5f1c58ef292429a0cb25c275f99bbc60b24ac41f2edafc2d8dce14dedeb7f2c3658fba5ceceb54a8364af34ac5e15da44afe427656f6ed197b3a54a3c557344a0a0e7dddb83047330426f71c07e1030ad12b4f4cb8254d153c943fd2f59bb777f83852a54c2bd1b7e14ef3a9670b4d0a9e47180d9d22a738ceafc9d044998c424f17098ace1c6bb518da6fb3a94d88d22acc84862c2799218a86def957a1fdaa979caab8d76824be66f413b9c5263c78b664a5a474b01f35f1889e53cc4a5a91e7ad6fffd0a", 0x5, 0x0, 0x3e}, 0x50) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a40), r1) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x40002148}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x34, r4, 0x800, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x5}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x1}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x24008000}, 0x20048000) (async) r5 = getpgrp(0x0) process_vm_readv(r5, &(0x7f0000000c40)=[{&(0x7f0000000b40)=""/239, 0xef}], 0x1, &(0x7f0000000e80)=[{&(0x7f0000000c80)=""/30, 0x1e}, {&(0x7f0000000cc0)=""/66, 0x42}, {&(0x7f0000000d40)=""/147, 0x93}, {&(0x7f0000000e00)=""/96, 0x60}], 0x4, 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000ec0)={0x80000001, 0x678, 0x1, 'queue0\x00', 0x6}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000fc0), r1) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r1, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x40, r6, 0x800, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x0, 0x30}}}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x5}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x41) (async, rerun: 64) sendmsg$nl_route(r1, &(0x7f00000012c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001280)={&(0x7f0000001100)=@can_newroute={0x160, 0x18, 0x200, 0x70bd27, 0x25dfdbfd, {0x1d, 0x1, 0x4}, [@CGW_FILTER={0xc, 0xb, {{0x1, 0x1, 0x1, 0x1}, {0x1}}}, @CGW_SRC_IF={0x8, 0x9, r3}, @CGW_MOD_SET={0x15, 0x4, {{{0x3, 0x1}, 0x5, 0x2, 0x0, 0x0, "ee1c6a0449a578d7"}, 0x1}}, @CGW_CS_CRC8={0x11e, 0x6, {0xc, 0x3f, 0x3b, 0x6, 0xfe, "c0eca94e5852dee218d4f14fd33679546ddb361cbc95003a6933f41b27c5d19f8d3ae8106a5065b00e7c7c51a6105db38e59c91174f2a6f2cfbe9ae94416004dc3ec523839d667bbc733873166dcad26a101820a14692c8dfd3aa783004329d14599abed66301fdec72c086006a5b9d613162722b3edc1ed27b0cf699ca7937bccc7217b9fefb98ddf73166aa064a3ae91a2156b3637d61aa481b245da6d4f1ae0c143f436d9242835846e7edd2baeac98517bd522cc91793358b8fec5c872ba67c35203e2845d847538ab39a8776dcb737bb527b987ba461b875840d18cfac057fcfeb58b368355a9ce1ec32f15e19e59f4b62d86e4cda910816230be5b2f29", 0x2, "1edf7eb5c6c05debcac4b76408f73425bed678ec"}}]}, 0x160}, 0x1, 0x0, 0x0, 0x41}, 0x1) (async, rerun: 64) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000001300)=0x7ff) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000001340)='./file0/file0\x00', 0x0) (rerun: 64) openat$cgroup_ro(r1, &(0x7f0000001380)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000013c0)) (async) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000001400)={@multicast1, @broadcast}, &(0x7f0000001440)=0xc) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_GET_TUNSRC(r7, &(0x7f0000001580)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001540)={&(0x7f00000014c0)={0x64, 0x0, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@SEG6_ATTR_HMACKEYID={0x8}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x963c, 0x0, 0x2, 0x1]}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x3}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x7}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x71e}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x6, 0x1, 0xfffffffc, 0x7]}]}, 0x64}}, 0x81) executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000000)='source', 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fef8ffff1971a4f0ff00000058b706000008ffffff9c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000004c000000b70000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761051ce540c772e201b2de17dfdb5b60939d5d6aed4062049b87e03e2cd18a77dda613e0c64497fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e015064716897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03440eafe1c8660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1423], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) dup(r3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x80001009, 0x0, 0x0, 'queue0\x00', 0xfffffffc}) write$sndseq(r6, &(0x7f0000000000), 0x0) executing program 2: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/hibernate_compression_threads', 0x60a02, 0x0) sendfile(r0, r0, 0x0, 0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r2, 0x4b44, 0x10000000000004) syz_emit_ethernet(0x56, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd604dd30800200601fe800000000000000000000000000023fe8000000000000000000000000000aa00004001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYRES32=0x0, @ANYRESHEX=0x0, @ANYRESOCT=r0, @ANYRES32=r0], 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101175129205705092006c7010201010902240001020010000904"], 0x0) executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000c995b3192c31e599cbe491fb3b9abb54000000000010000000100000000502001331e9b30000"], 0x0, 0x2d}, 0x28) r0 = eventfd(0x5f0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r0}) mmap(&(0x7f00001a1000/0x2000)=nil, 0x2000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xae85f0dda6d4cdb4, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) socket(0x22, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x106f) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f00000001c0)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000840) ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@delchain={0x74, 0x65, 0x10, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xe, 0xffe0}, {0xe, 0x1}, {0x0, 0xe}}, [@TCA_RATE={0x6, 0x5, {0x2, 0xfb}}, @filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_IPV4_SRC={0x8, 0xa, @dev={0xac, 0x14, 0x14, 0x3f}}, @TCA_FLOWER_KEY_ETH_SRC_MASK={0xa, 0x7, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}, @TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}]}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x194f}]}, 0x74}}, 0x0) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r9, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000c995b3192c31e599cbe491fb3b9abb54000000000010000000100000000502001331e9b30000"], 0x0, 0x2d}, 0x28) r0 = eventfd(0x5f0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r0}) mmap(&(0x7f00001a1000/0x2000)=nil, 0x2000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xae85f0dda6d4cdb4, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) socket(0x22, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x106f) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f00000001c0)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@delchain={0x74, 0x65, 0x10, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xe, 0xffe0}, {0xe, 0x1}, {0x0, 0xe}}, [@TCA_RATE={0x6, 0x5, {0x2, 0xfb}}, @filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_IPV4_SRC={0x8, 0xa, @dev={0xac, 0x14, 0x14, 0x3f}}, @TCA_FLOWER_KEY_ETH_SRC_MASK={0xa, 0x7, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}, @TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}]}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x194f}]}, 0x74}}, 0x0) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r9, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) executing program 1: ioperm(0x6, 0x9, 0x824) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @tid=r0}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$nl_generic(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xd80}, 0x1, 0x0, 0x0, 0x40408c4}, 0x4c000) setns(0xc9, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r5, &(0x7f0000000000)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000ff9002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000000)={0x3, 0x5}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x485, 0x0, 0x20020165}]}) socket$inet6(0xa, 0x2, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$uac2(0x0, 0x9f, &(0x7f0000000580)=ANY=[@ANYBLOB="12015002000000101e04003040000102030109028d000301008000080b000201032005090400000001012000092401020001150003052403020404fc02030700f7090401000001028000090401010101022000082402010603090310240102f1010300000003e207000009000206ff2f082501803304030009040200000102200009040201010102200009058209ff0309408008398097e87fa073490cff250102"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) socket$key(0xf, 0x3, 0x2) write$selinux_load(0xffffffffffffffff, 0x0, 0x65) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) executing program 4: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0xee01, 0xee00) (async) syz_fuse_handle_req(r0, &(0x7f0000006280)="897c6500ff3035465c7acb4e06980b05687c1480c7aafe631c0543db2bf0d6f539506e8782da06c1ca018774d72e9e5a3418ab66ee78dad68457b17ec9d47bf7d8272d607c1c0a4bd906f0cee7f8451828d2458596bdd6a459ba18ebaf61b38f5d66c27fa8a024ad7832a85e58689a4c254c94cbcf7208fce6e61d9566459789d15a6f91dd7db7c54cc3a94da956fb290a8a15f849270bc459d9d9f47801be86dd5c9d18382081a993b7bfde5c28adca4c71329afd6be743b076033b5859891703eb65fa256d6f47450b6edacbd05a9bd8b372e90cfc30f32826566dac6c48e6ef001881cbc30482f9ec469e476a101da496b8c0785eaf875d3608b0c49e9d39baaa1041f903a805f0f24aa63722fa2d87b98595fa5cfaf8b79c458de43ee39904e7cac7540a934b4108957785d58807abff186949f1b94cd21b724aff34ac45c7066dcdbd68ea7b766af9d045cd7fafeafc5c5a0c3400ef4e0c71a6fdd5b8d68a6f317644cda9d2fd2c839a82b97b3d909b54c672227bef573c9de1991d65a63017f724d1f7f1575e69db53318a7fd7065b303e751518c8eef04f642dbd4dfa349040a7b5401050ffc2b4ef62803a7c8eaba99e011dfac24d81b2b61e0b0581e53bf520f623eca17f0545c5e59ff15b527475f970f589894ae589145fa4283f7225088ccfeba1d72e9128f8c223ae1840f2edae3dbcdf7e560d5cdf4f71c9ada1931c0f8312c000101b264aaddb9fab166ba8d8903d6098eca20935ca607ea79e936798b3dfb22a7e159abb234cf21f3733dbf263a8ff116092f251659108892b2e21e1b428fd225096a5040270b2d70347013eaa1fd8e452942200283aab092c4ffc5b8b427b5d691a5a773e09da20539ff0f8214331c5d84107ae8a59aeb58efe22d7a079e446f1dfb07510377799bfdc7ee59cabcd76af0fe8a427ac8258ff33bbad5a8061f1cfdfbf375d73d676cc7916d6658ce46a0b17ad6350150f98e3512b513e25ca73f5f5df0a1fb9582ace7906c493fe1fd2889d9aac0b7c29c2b6c205537627bad64df433336a5ace32ca871e51b4dab0fbb00886a1fa81a98b74de0a26cebf65723515ebb807fc3c161ed42d1a7b6b55717613577ea437f3a2967c66ce45ff85a6a35b7cd40625fc575b107d7394e3d2db51d58347276c33e21f50b5a6b5672bf9fda63139bb75aead1fe4ee9a4064af5a5958466aa39faa6d821489fa415224c8d69d3b5922236832c2b1e4f6b8863b32f9aea83fb522a2de081d674502b48f73ce6db98d84136059b4a6676bc85ac6b7626329afa9bc7d3f9f2caa3d4d872744e0a8e02d72a75c6c545b8ec8e15b6fb0fe4185bd0d154960e6fef05ba40e5fe2968eb1301dcc52a03337179e74ba1522af93d77827845f8941c69ed8bb84567e3c63f1cc378a542f1de7007b688ff0a9c69d5861f0b85402c30a2fd391c52bafbe65f8e82135fd38361d7c0b43c982b2f3e7cb09c40c7e215114f4243d670cd576bcd93c1e959345170c75d6c3cf89cf8c2c70dc792e646e7c649d4c5f36bb016c7acd466ad58473d40dfef36394e581065a8581ab852250403cf372ac0065bf757fa3f445424ac0d82aec1938a2ea116bdfd306baa1cb06c62a4a97d66ab1b9489469cb8ba842da12e310caed02c5ef05c0be1e1e8c9c8b87d6871c94c57d164d08672b205c948086a06a545b266b7ad902a908681eb188bc51b6190b5cb9d8ca59b8c4c6e7369c00d6f6119fd5d437239e3d3c89cb81e09e560fb817590106015f08e7b09f1e1e65bfab3b8489fa058e24081978b9e25463d9945bfbca81c08885d4b6d4c62e217bd9e19460762f36c66bc948fe31cde089626fbb310e3c78a8d3f2eac21d374d9b58d887235d3a95721168e4b9475849071d60ecfe7ea5d6c4bf60da3747612ef59bb651270f326c0af31bc8c71361f851de34ccb3c8071b96f1128d7ee79b41246e566edd0272dbd3ccfe472b38e5e03d3ef83218bd498e6de8b4d92cb6f82716449ede7ba845028eccdb9137be8a622ac88ac53118fbc39637fa7a93cd3abc6f7671c7804420d66e94720acbcac916950f9baca77fef4217155ccc2cd0507339a0486f9f468eb28772986ee768c63eba671bf8c52e48a2a5dc2cc24fe925368706c2d712dd1064692b0fb2a32ddfbd4a0ffcf9c2abcedaae6e527bc1d42637aff2a275b76a7a7f010e42e1cc1d27141f6c3585a2bf58c6c5789ce61551d10118a000e3764631ec0b7f4b1a6f22a678133a30940b79dc76f863dd9f6e0d7776300898c97cef286c731c2050928c492439256e481652bff0d202db3cfdc54c9816ceea7895357bfa0362fad79afd09ed55189294d6ead7e898ac091cddbe7efcedb314bc02a18dd5bbddc42e089124758bb491fd1536aab27c5c124567bc325e7028bced5a179a011d1cb9a5ffb61d7af863e91ec8e60495561188b74d158ba1418228d44e92915a22eb1c166ef7d6179e84381ed950ffd747f13e24172942d922ca3109fb8b1e4e6264fa4a4eec75ad0d0e22579d90f45d6cd157300e38ae665eb56457202e25a8dd5877ba99725de288660badd2704345d9bad208c903ba27ea167dd45a77f77b6502b525b2973270582858183c784c324c1366fbba8d410c38bf75b41e067f6a9a017c56595161db4fc5639393fdafb1f148d3f416c1adc5fe1ab9cebe4689855c9b4bda6dcba5d5fa858a1b87d2ad23cdf54dbdf4d14aa4462da0b6f1107f4afa0091c2643508861a4d9f133ba77751941bb8fb756abf1a104205b80d47a3b4a59724d959c8b5833da4f56fb6613231f230a9378c9af741e94fd2c7213ac1d7625559b3f032f6c8df3ab441929720fe43d7c548cc661eed5b3c62b3c61f538ea3228376e2a18c6da2ad906322f64fb4865cde8e1889a8e5237fd6a39bbd6662f1dedc22fbd74e4376fa610cd710703dbd3924a38beae69783d1d5abf36122cbb87129ba719042748f060f4303a3199c5891c5040fd8cdb9761b006bf64cdcb65e5cc50a29994b8c1c34b83760ece12ed9ed7c3d2a7f8911cdf23a1afe0d7db1bf342aa0123dd5cd31339f5c8e160c4efef882602b3eccbe76fb690162b8bfb8a31910bcdf9a4a5dde76c2ac2fcd8678add7a000cfdcab398eb2171c026313eb6eb56b4b87bf8ef93f7f8a1c0bcc3775b681d4229ea561cb52281d8ba4315c3694ed08433596884d5a7ce3a8b1f82359846b7136726e2fe37bf4f7b7e2206cdcdb0705ced9f0dcaaa2ed3a78ea70d2cfeab668eb321400fc955e9aeb7bbcf86cd03f02dd443503a1480d9d9f899f53bd747a95293786798fc59fceb09e686a9328da4f929b6201841bbbefaffcf3386abdf69540e3b46a643ec10f0acf21f27c0053dc13f18485dbc898729dfbeaaa4887b58cd442d7ffa941808cd9658595be8650a815b088621278d89f0d8a4252566b923df3a3cd65c0e4af08fad385927251b31d35f75eaf25e6cf13a579aeeb0bcc0a14ca4a20a6831d532be0b2af3821792a2df95131b7fafef245aa19b214053342aa820c35858d13f84e496294529411015c41ed447b5b51dc44a45d52552a2be1abfc157f3ace7bfa32d5b931421d5a152dd66b7bf549311b08325e5a7201f793037b38990bedeca8a647c08d2478670f8fc2b4e8983ea18bcd514daeeeeb9d7a778f783c76edf01bd4beda4b77b612cd2e865c2e4f58ca7ae06147bf66ae6aee221cf9b9505dc07e6fb6cf4f82dc8c406c78e270210c11cf2531011ed678d9dfe1f49c9a69a95a9f3b0e5b624d9c2664d787ab911b75a4a38d63e9d6c353f8aaf433ff961fe5e34d84936ead0d0bc7954caf84e541f5c6f3f20c9eed21eb0316b82c0dc5182540e63a0af25565496792153d6395adc2b8d68b8bcd93dd110ff5685879db4384ec390d44b89663d43a5de3bdc0e103b7c1b355dc5f6fe3518c93628780ba03f156badea65d1d0af8433c9e8a975fdd19453da662a33fa9f0f5fa15fdb216b483fb48370a967246e0b763df8b3bc7924a6c76c4b114f803dbfa3b312e6815b4eb67be167283a9e482d9a5beac250089d069d4c386b7fda5fc228404a0f58b12ca4dc131c381b49b42b570bcfc0dd663f24afaf65a26a21f6d92f52c9f8de36cb76bacbaa0eef98ba6b7dbbc2629a03bb2b6f83fc5adaf20c217bc8d0f0d2421e01472532bcb546aeb2d483c8f95011a3ba1d2fd8086a717cb015dd53064ef4a80b6d6fdc12d9069223fdf2aa9b192a0e0bdb38436f49d9eedfef3665815633fee4344aff11162526362b70b18e1dbedbb5d8c4698860beccf667851878a25a1e766caae2861f2e23404aac859e62fdfeac06a6057554828d7035806e8ab3ee2fa6d711e5811db61231a22f4672f6a11b27641f350bcab78792362e6ebc1c054a643bbbf2746678c14dc567d1f73e37005c8ab6374c4d8d3106384a2d32c5fcf05cb9ba97cb7fa1aff11505a701bead543e555f3901ef3b693d5b9ebf49518c3509af042b7e84b1b867c22b7e08725220e4338fd074edce428212e6a3563a08e2ccd8ab71910256532904542e93d5c7deb5bf5d49beb3202d4da4f643649e55edbb91188cdcf0883a40c6ed6b8a086fb5c50dc08fee00308420121d4c7431b3cfb80f9c1e099423ac451d67b12e930d9e391d0a799c7d4b54a0d56ea0aae00c1d009e21fb5459416b464b227d66ccc1a68da59d64c1583dee54bbcd7d61ffe541fd0fb7452adba91906932966a7d58019ad1f8fdebeceeed7018837b6e4272eefeec8385abe7207fb2d7061fa6cdc478165a98971f9729b818a73edefed976d5c7c0a651c091cfd1174c020e39330a79144271fe4cbc61ea0ffa274d0d87d06dd08c1d5f8a0364d46ef7b54426bc286330c75fa257afeb2715c2ae511ff53b1189cc59ab80b1325fbdcedfdb8f36ed71f70091116e16b52188b794e637755027caac8db8554f8674b844964c710cacd7a9d6b06baf6fef76159a380e639b0d3e66080a7cf7f86baac01dbe47fe687fcef2f3bfbf6f8fba045181dee688360a11ee56e5fc73ed31c0e2924ae57f0cc93c63a30662a65c5d5f17123ae28cc5b74dd13ed81b03dc7fa61dc575668868c0df12d3553269f04ba79084d070abcdbd4745de80e90e4e3e524f27249b5c4a2f2d4c8b331b0cb6d4efe62a298daacc6eacdfe008c1f912795dbdc37098c42db860953120fda709baa6d46f52eaba781505e68561ca0f281e850532ef8e7c779883e312806e1c357bdef8d0dda005e710cfa6eb8686e8bf3bff036b3fcdc4036541d93530ce6f598442c24170b307ef05f23c93aa0ec96831b532d8120402214a940d1fa01ed649061a4a71308be189cffd729a196754fb8a75f23851189589be1b819f0612cad3dc94ccee88f4ab9ef6ac9c7daad8cf94f5ed9496c4c824e5b4f66ce32a80e7a6ef069a32f6812e656aa5f5742bd432afdf026c86e8f28212c1139dad47d7fc07e5c1a83e993daaa4a4bb5f0c9435ccab2a10f867ffe259dba7a1d9168619b1e3048860a5122e4a5d0b00372eaae861a0cc88549852fffa76e6d78739b654d67df15ea97a9a46b7c382d83191a673aa619b4a10ec05bc681379b0d6df824cb6fe158e9d89ae5dd1ef66976f67972b553db52eb6feef836dca6026293f83a61e117754a7424a3da63bd82d017f87f0603e2a9b8fc550aae611681935ae91f7ca2b5341b05a25208bd28f1a202a7f2a213b1d7411ffb557470aec00c4d13c70163f22a038a189710dd19a47e8db4a87c3fd329a63abca172a9810edad2d8e19ef85b57ea4287cfb3d740d7ea3fa9c80d06e1aa84b317f678ddb3c147ba5e0db432125f59ca4944c8e9050281ca82a3ecf67b2a5df678697a52a7297af1ecb03c586af7b91d74e881964ed95f7be12fa07e2a4e71aab8b913a13996fa33e915144bf00e49b8e7adec5b2c4b8165f54ba3155230e241ee023af77a295ab87c40f63f6092ccee05cb08a265abe8f57c9919bf45064b6c2240ba8011db223a283a4e2292d9b59df8c9a4fdc763f0631007db9976f351717db0e6b5f9c6e5f227c2efa1ae5fe0be1af0b22fc164f9f9678a01fe8b059749fe8a2972455732da1989c609d191544ef9fbb3e58da93ec4a582430523f260b776e4d747312747d18a9bae14740f5dcd35fd1072f8a4d81573b5882203be856b62d7e1d87081a9e431872c9d68864197bbc61f15dd8aeae950d34d6ce97182deebd2ad64cabd1c723baf512acfc7e94675b31369bd60e155af79b97bb734312569f736dcd5b5a78223ffaa0f7e93e1a112cb9f6a5b88fe3cf12c30024c16c6b8380fdf086c662665d3751c11617cc4dbd5b8bc7543301a23fbc90ba8d060193cdc2b68c31c734d516707b759f7db009c8f06e69b40154e1cd8ae444afb28134acdf871136b4fd78bd86d7faaaf618afb25e92d1ee37cdff0595278f9565f5eb109e181e9cacec2f22e32e9f34774ee223fdb992febcc5dbc5cceeda16cbcf1434730d859e7e03d36ff17636a7a7e66956b515894da114f3040909f90ce3cfbb2d7d46e37049c0fb124e0683d662eb427cd7b851ada229451e6e3aaee64b9964ced3036bde5d9d80eb062474f96ecfb9b65fcafc719494ac12ab7df245475f2a5e7f85ca4789833ca373e6214d39176c8f51dde87a4cfe5414a20f68bb9f34709979b99533ba3435c4aa56e525195e10ffd00f8e41aee30a909c07b973bbf733d45500b539ebe2206d438216690998d9e256db1b7ac6bef3e810785e1986985c945a2b820323a592721fcfa444934d0faf8aa439d5efca5dcd77b72d1eb91b3790d50d0a7483e354c415f81d99c133d648c1293e795b3c43f9b47e23ef982e10072ea5baafb0df675e69af1807b225afa0cec3eafbde8535d3ecaa0ea6ddbffe4465207425bb003670320324df0aeeb16b38a043f9c0e85673b36def332fd68b2b1e6edda621d0cadebbced8c7fc8f890489115b457249e8d8103676b3207a472804d33e0fe511ac56cd8dc5333b2333892f87b455940ada78fcf5075c358fce990e6f65f095eb416d876ce6f120b8b02cfa6b176ee269c942f881247c3e464cce2aa65c39137607c585aeb4b5f24f5f8e058c9c8b48003c1809da3e8aad1bee7955c3a976d43fe132e2b16f4758a0a9884e51d13b930675a4361ff366b0fed190ad7b2a00385528951e39cd44ea06d8921b9d613d7626221154cf86249a550198fe4e5b05ad3052b474291da0a0a2f701759859bc0392adf243ad5eca89e6d18e28dff99ef95743bcabe75504be8c715cd6360facf3bb06cb97c29989d4f6ff5083573cefe6ef0b39a252a2678112fa88e5b06c9a6bfc9597cc96e5a49710c4fc120fb0da4945b9d94e46de1e9989d0fc3d8d20df23d815b660c799a903f651b0d013f7fe158f1d297f7fcb6a48780ca5525f1d081ada0aafa83552318b848783306549750b6254cf676c7b934cf7fdab992717f0cdc089b34278f3fb151cadde14d0d3250e85a4b0ff2a2778a219aa40563d3ef575285484424b6d0e7cc8392342e4848c6fc8cb20fa1b450cc4c1fea19f3bbdd9e342e6c49cd7ac893b1eda2e93d1d74d20969465946b398fbc733757741ac822c4a118632cd242a439fc37512cf79b7c629504ccc1e7f2f11798955c3262b5e9695625ba74d8050e20f51d4769e1ab938f487f1bc4b55b5abcaa3ec079c2d0972b2ae9bfb7c5423b959119292ea05f1d79d35afe47e49d97c946b193bffc0a8f607f18a6845cecbbdd98cd351db2b2dce05a4848ba84a6a497b4618950130cb7e76c03d0976eb2fb41d3a42a1430063ed8e5b8c67e80fd4fc1148911958babbcbff33a6505de209b0d9320017fd736fd027a16564008ab2e1f48a6dd66c9256730e9fda0a606875d0871b2b9b0bc2ed4e1b696dbf0283c8dc72cf4338e595266f5390bc3a21f988353118f2948fc75d050ea076b73508d9ed89bade0ba305c1f4e5daf9d40d2f5e7ababed8d1b1d919c61a6d3fb149c1a9b44e38585a2fe322f83d73a3aecb44da3f0e82942d75d62ed3f91eb44f3411df014f88839e4cb1e21b9b259d4eb4adaf6b0be433d0ed4c87ec77dde5ee9d566e3dd8d928fc1875c63af26c59daba5ae267d9bd5da72b99a03e6a33cc48ed961ab484ff4a46c2d5fa597e626e00b530d7b9a9705e4e08d03f3a7f2a5a5233ad6340e3b5c89db81ca713b6d7d855c6324955f85109b204566f50178cd88abe3fcba25de905e8ea0b75ad51831761ed9b1af2470f976f05ec73bf74d137c207270cfd614170518cdc449aeeb663e114359c8124eaf2499d8cf5dc84a0872301db2e57b50bd285060ec4390d99d4ae3674ca3bb8679c1b08e566ba4f30daec8684a980055eb43cb5a1306c4b52a154682aa96637e06c869278aa2f74ef7345632c11265ef8ac97e953745302556881ba0cb590fef271c0abb193fb84d18ee3f24d9976ae816b857d6f68d1fdfe10b312c799fe014debf875d04bff8b4f387859e97c6bf13f7083c28a2045a0b5eb09c94e781a165965e8617c0efed1701ea9667aeca26d9577ea7b1242e1d91b25d6a66756cc627648a293b9f4345966bc469fafaeddc1118d0972bd5c7751a1f51e5989fd952f314ae10417c97b41e60ebfbc47e496486fa4a89fd16aea7fa1eabebd26eb2a37a3e2b351e0c9d2f67b2e5be0f921adc9b6045b045948e5103af0e5050b9c0799b513c00865deebda730de538f956ceb6164e08bd6f58655a294b4b44fc65309b30f9c00f92ef5bd5b911a3d830f72c258b19521bb8e80db02129954efb61423f518d2c5f36587303890cad9a93fa4f4bcd0e24c67db679c67ea59c1350b8442577632d5e8735833f3daf5a74bc7bd82659a81beba8c889632efe03cd24187aee856cf659e16e195464f52f2b984fc7a299e7b2aa53979a147ebed35705d5e89691666536f2febacfcef9b32d14952f958b72512869e4f6a0a34176918217888b1eb8b89322ebb6bb1dead2b4744e728479880db70e6147edaff6c3f083f18e0696bdbd78cf0bda14d9f42e5c1077ced00041aadff90470aacec0e48e2a5f2a0ed37818a173b96061e8c5bf24c0bde9e09f9e0ddb8e13306ef1d4eb8043ebadde5d7553e5212ecd4691eb426251f9d6720b8276ac543dde02399a35d974b1ec1727d4b6df01957cae47443b706d43165e01d6932b136f561ce837431254cfb2a6e7d8070a2d3805aaa15b3c10ccd0cda2e9b418ce9ef380e5d08217752e12b3b892d03a9495c83d78d674612fde5a67738b2d4649ce44606ecce6bf3bd1293eca246a83643e4f1c7ba362b110e07c8479f216e3d4afc4fcb8d0820c8ab702a66d8183e83174597035e92b9b500dee08c80b927b42c3689c7c9617b4112c9e54cbfa51e989b5fd42b80c595d3edd265f138e8128cfbbb0e4f53aa0aa95a2ecda451852e564c42d5de7671560843d08103b9bdceac5fdeb0b1266f72f491265dd2b2b80a225a50955167da1812364ea340d82f61535401bae6f3140a8795d7c318a64cee4676627244930957b2f0b227be21b72d90027e6a5a7af3c59470c74dcdb71d1ef090a0f49c91acd604c792385c8f4e085765292822ee5eca03885fd6bfeaca9b3bbbdeac939f7846a487c5a483ed1e4fbf37c93886ea27bb35c812089b900b77c7c924147e97b6a71533610750bc84921012aa8158b213f7601d934a20bdd1f757b0a33042a683af6b9069f3900059d7f80f9fdcc9f33ece8cf7888dc9e24f1fc6ca0ecccf161c5334c60f440feb3acfc3d115011c176dfa05314c5bcf089e3c82bbe7680a3eefdcdbf3ac27265b779db4f49bade0128eda6e29bc5933ef454601db1b49628fd39ab938794fa46a33937a086ece7050d31a21524e2f0cacb307ed4412a2078636f9cc8e11c5c31cc0f9edd7be6d1e31a1513a58e25215f5a24245cb988589e6d5e5119f4f6557c697fad7d1c3a7e3bae064db4382701e33e48c5b6a52fe9141a385ef2325c6f7781134607e98bfd02c43d6deefaa861700388b40d98e941cfb2ddec209f977e8b9f93d29fdbf85e3010ce7cd622e8c75ce3df535e392052b6d65d5042d2a6e78bbfe5ee146e8b18d4bc7fb024dbba57cbe0402205593766a313950cb719d00c67bb6b3bcaa1015b89e820f11475afce655947113a7c3dcbb52427f090df994fbf076db867e0ab3f6125fb8884c1d13ff3e99fab5fa8b9f0b72cb44db4d0a48d9ec17f9733764e213c40a15ad821ec60e4a88cb2fd9dd9a4f35e6a708f4b74067f4be3f03a95261f6b191df53fa5bb5164e4a164630ad9ce39087aa950ad9e60cbbc44fa2237c49abf858c97737fd21180fd0b9542767150fbed3f39a29e6c3484d9437e15d2439f2a54b2a1ac7e63e6c436658abc3f1dd52d984f6c6901768a8cf2ec98ebf44e90e0fc0c24f8957c62e05d8eacecaf25b178fd710af609a8a1bc4d7955b5f0cb4f48a37685e6304ea5843573a1abff37b5106916c83c8f23f939a0dc43aea8d196191ed6e18dd793990d1f37d7de0bf8fac6f469843724eaab86be8a483be281b8ecf4aa29d9c571951cde8cd8c2aaf4d597ac2cb48f23fad145916920a55d655924940573b64dbd42a280cddc4810434f930183fdbbdc72db1491a4c9d44daf9b1bc2fecd855508648063040faeb125da0e68e6cd2002181118eecff0be1dd8eae726af5d451630cd65119c52abd6dded97f931202f186a18c4ba34bc2c3f6d765e2d8f445e959f26ffb55827cf3ff2cc0289f17b82c8caa5a2d3d54306a300f0ef42bbe4ea9e32c5d4b1173942745cdcfe4f5d1619eefaf8dc600afbc9171d516f7f4b35331d0b9be005132ffad5e9df59710278b842afb626a78b8b8b37fc3a894dc705b2d4e0940cb264e9dc87eaa148e6faf78125462f28a0f1d7b3c65a291b85713fa71ffc478f6601e8716c35489f4a54ed0c70bcfd5502cc91374dc3c982075c5180398bc6b195b36e79dcc4087cb990cc9d964a150e0dcc887d496bdd27c3f298736b9ad8345ba2df46021964cf43c38f9d2e94b77bee2b7bf059e0870ff9f17b9ef1320c0aa88a2fa9781e9017ab64643de9a3df9ed4b8cfd8fa080a2e494409520b795eb1517d224a05e450c4c8ae0e9fd29c0e72d3a592cce55f6dd5107f21214e1a3f9a5448384de06149f959ec0c92790f0ff229ab4971171f1c528ae6d095ec007bf5e7f55d623a68194e9ea8edc3af4180753388f24e7504341c22bef72c2963fc9c3237ba990d29c2c8aa3007395f6d96e95b40ee1b18dbad550bf39d0d98268cb74dde76d987c3169c9067495fb1b88508bbb7e94cbb7dfc15c03b1d5b163132c8a468906f02d422a8cf98d0b432b5779dd962074b72dd27439b2e94312f573435e5aa84664432c1914839cd6e172186ce93eeb1d7cb0659696d9d550eb3b185f8c6ee16e53f78233cbe709f99d2879d63d93f7d0ed133241d2f1ab1eb2c56605ca0f0e01c39ab0ba2370fe5c4e68de0561b517ff9a10023c386236398372c7176e35443e2cf5dd6cbed9f23395f231e6a54f65626cb5860a8b72122c34664119e7c47204ef4a70583a00", 0x2000, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) write$FUSE_INIT(r0, &(0x7f0000000380)={0x50, 0x0, r2, {0x7, 0x27, 0x40000, 0x801001a, 0x1, 0xfffe, 0x3, 0xffff, 0x0, 0x0, 0x41, 0x40000}}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_usb_connect(0x5, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_FUNCS(r4, 0x705, 0x0) (async) ioctl$AUTOFS_IOC_READY(r3, 0x9360, 0xffffffffffffffa8) (async) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f00000000c0)=0x8) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e8000000000000000b210000ff3f7c081e0f315b91fcaec7bf495d5c618332756cbb1bb9ce6d12b9d976d1f33aca41e50a3342bcd67c311f7885a05c3fcf2ae21f1498ec481e7ca2c3ca4c7b3bf94448f62e111e5a79929b9182cc977ba6ae766ce37bdaac6da997fbc15f0c79f42155b99a280667b51fdc7902d7be5ef41f953fedb32aceeada13250626957e2013d5b12cc916541ccbeb0d4060a4dd89664eaba2f6b4ede0c9e3dc1c9446d9284ebe0e46eee7bc145ff0a2779c025553298812978ea53a8c60f254f23344a80a0aac7b141787bad6b0ba090000005f2f3158f0d200000000000070000000000000000701000040000000afbb30c2946e41ef3167d1f6ed47aa1f52bad114a89dbed741f74a23cd8d915e2dcc74a4932646b90f90a9d3956d5cadb642ac79fcb0aae3654482188263abd27e9d57cc28032453dc75f333e1f367ab38b7e7719805a454e79802d07ec60c00b0000000000000000100000001"], 0x208}, 0x0) (async) r6 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x2f) pwritev2(r6, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x5a00, 0x0, 0x3) (async) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg(r8, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x208}, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) executing program 0: waitid(0x1, 0x0, 0x0, 0x1000008, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x2000000, {0x7}}, [@NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x43f, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x11c}, @NFTA_SET_DATA_TYPE={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000001a40)=ANY=[@ANYBLOB="18000000fcbfffff81162800000000009500000000000000"], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x1b, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) write$P9_RWRITE(r9, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288, 0x0, r9}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, r9, 0x1, 0x5, 0x4}, 0x50) executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000100)='ocfs2_dlmfs\x00', 0x2008, &(0x7f00000001c0)='diccard') openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRES8=r0, @ANYRESHEX, @ANYRESHEX]) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-openat$procfs-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) write$P9_RWRITE(r9, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288, 0x0, r9}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, r9, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init single: successfully extracted reproducer found reproducer with 25 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-openat$procfs-write$P9_RWRITE-io_uring_setup detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00'}) (async, rerun: 64) r8 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) write$P9_RWRITE(r8, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288, 0x0, r8}) (async) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-openat$procfs-write$P9_RWRITE-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) write$P9_RWRITE(r9, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, r9, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-openat$procfs-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) r9 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288, 0x0, r9}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, r9, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-ioctl$ifreq_SIOCGIFINDEX_wireguard-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) (async, rerun: 64) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', r8, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-move_pages-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-writev-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-syz_open_dev$sndmidi-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) (rerun: 64) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-shmctl$SHM_STAT_ANY-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) (async, rerun: 64) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-prlimit64-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-prctl$PR_SCHED_CORE-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-ioctl$TIOCGSID-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) (rerun: 64) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$sequencer2-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-ioctl$KVM_CREATE_VCPU-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x9) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_CAP_SPLIT_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc53}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-mmap$IORING_OFF_SQ_RING-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) munlockall() (async, rerun: 64) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-munlockall-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) munlockall() (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x4004550d, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-syz_open_dev$usbfs-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000080), 0x2077, 0x101301) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101700, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, 0x0) (async) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0xff}, 0x9) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) (async) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, &(0x7f0000000140)={0x0, 0x5941, 0x40100, 0x1, 0x288}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-write$P9_RWRITE-io_uring_setup-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0xc0980, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4048aec9, &(0x7f0000000840)={0x6, 0x0, @ioapic={0xe000, 0xcb, 0x401, 0x400, 0x0, [{0xfc, 0xad, 0x7, '\x00', 0x3}, {0x2, 0xd7, 0x80, '\x00', 0xde}, {0xfe, 0x1, 0x3}, {0x8, 0x7, 0x3, '\x00', 0x2}, {0xfd, 0xa, 0x8, '\x00', 0x1}, {0x59, 0x7, 0xf, '\x00', 0x6}, {0xc, 0x8, 0x0, '\x00', 0x1}, {0x3, 0xb, 0x8, '\x00', 0x9}, {0x4, 0xf, 0x5, '\x00', 0x3}, {0x3, 0x1, 0x3, '\x00', 0x86}, {0x7, 0x71, 0x8, '\x00', 0x8}, {0x9, 0x3, 0x3, '\x00', 0x16}, {0x4, 0x9, 0x7f}, {0x8, 0xa, 0xa, '\x00', 0x8}, {0x4b, 0x8, 0x1, '\x00', 0x7f}, {0x0, 0x13, 0x0, '\x00', 0x1}, {0x8c, 0xf8, 0xe, '\x00', 0x7e}, {0x3, 0x8, 0x73, '\x00', 0xff}, {0x4, 0xe8, 0x1, '\x00', 0x81}, {0x3, 0x8b, 0xd3, '\x00', 0x4}, {0xfc, 0x6d, 0xf9, '\x00', 0x8}, {0xff, 0x2, 0x1, '\x00', 0x26}, {0xe, 0xce, 0x0, '\x00', 0x1c}, {0x5, 0x8, 0x8, '\x00', 0xd}]}}) (async) write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4516, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x4}, 0x50) program crashed: KASAN: use-after-free Read in kvm_xen_shared_info_init validation run: crashed=true reproducing took 1h33m42.542913566s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in kvm_xen_shared_info_init+0x3c6/0x440 arch/x86/kvm/xen.c:90 Read of size 4 at addr ffff8880599c2900 by task syz.2.383/7257 CPU: 1 UID: 0 PID: 7257 Comm: syz.2.383 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 kvm_xen_shared_info_init+0x3c6/0x440 arch/x86/kvm/xen.c:90 kvm_xen_hvm_set_attr+0xcef/0x16a0 arch/x86/kvm/xen.c:806 kvm_arch_vm_ioctl+0x2a0/0x18d0 arch/x86/kvm/x86.c:7514 kvm_vm_ioctl+0x1560/0x4180 virt/kvm/kvm_main.c:5381 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f03cc39e019 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f03cd189028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f03cc626090 RCX: 00007f03cc39e019 RDX: 0000200000000840 RSI: 000000004048aec9 RDI: 0000000000000004 RBP: 00007f03cc43500c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f03cc626128 R14: 00007f03cc626090 R15: 00007ffd770bb9c8 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xe pfn:0x599c2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001a41648 ffff8880b85414b0 0000000000000000 raw: 000000000000000e 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 7257, tgid 7253 (syz.2.383), ts 169739507412, free_ts 169740156503 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490 folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1917 shmem_alloc_and_add_folio+0x371/0xd40 mm/shmem.c:1959 shmem_get_folio_gfp+0x6ad/0x1910 mm/shmem.c:2512 shmem_fault+0x1f9/0xa20 mm/shmem.c:2713 __do_fault+0x10b/0x440 mm/memory.c:5425 do_shared_fault mm/memory.c:5924 [inline] do_fault+0x2db/0x1750 mm/memory.c:5998 do_pte_missing mm/memory.c:4566 [inline] handle_pte_fault mm/memory.c:6379 [inline] __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6517 handle_mm_fault+0x37b/0xa30 mm/memory.c:6686 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x1178/0x32a0 mm/gup.c:1428 __get_user_pages_locked mm/gup.c:1752 [inline] get_user_pages_unlocked+0x30a/0x7d0 mm/gup.c:2681 hva_to_pfn_slow virt/kvm/kvm_main.c:2903 [inline] hva_to_pfn+0x871/0xd60 virt/kvm/kvm_main.c:2999 page last free pid 7257 tgid 7253 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 __folio_put+0x3b4/0x5f0 mm/swap.c:112 folio_put include/linux/mm.h:2124 [inline] put_page include/linux/mm.h:2193 [inline] kvm_release_page_clean virt/kvm/kvm_main.c:2813 [inline] kvm_release_page_clean+0x1dc/0x250 virt/kvm/kvm_main.c:2807 hva_to_pfn_retry virt/kvm/pfncache.c:246 [inline] __kvm_gpc_refresh+0x1a63/0x22d0 virt/kvm/pfncache.c:330 __kvm_gpc_activate+0x2ab/0x490 virt/kvm/pfncache.c:424 kvm_gpc_activate_hva+0x73/0xa0 virt/kvm/pfncache.c:444 kvm_xen_hvm_set_attr+0x395/0x16a0 arch/x86/kvm/xen.c:798 kvm_arch_vm_ioctl+0x2a0/0x18d0 arch/x86/kvm/x86.c:7514 kvm_vm_ioctl+0x1560/0x4180 virt/kvm/kvm_main.c:5381 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880599c2800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880599c2880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8880599c2900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880599c2980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880599c2a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in kvm_xen_shared_info_init+0x3c6/0x440 arch/x86/kvm/xen.c:90 Read of size 4 at addr ffff8880599c2900 by task syz.2.383/7257 CPU: 1 UID: 0 PID: 7257 Comm: syz.2.383 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 kvm_xen_shared_info_init+0x3c6/0x440 arch/x86/kvm/xen.c:90 kvm_xen_hvm_set_attr+0xcef/0x16a0 arch/x86/kvm/xen.c:806 kvm_arch_vm_ioctl+0x2a0/0x18d0 arch/x86/kvm/x86.c:7514 kvm_vm_ioctl+0x1560/0x4180 virt/kvm/kvm_main.c:5381 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f03cc39e019 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f03cd189028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f03cc626090 RCX: 00007f03cc39e019 RDX: 0000200000000840 RSI: 000000004048aec9 RDI: 0000000000000004 RBP: 00007f03cc43500c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f03cc626128 R14: 00007f03cc626090 R15: 00007ffd770bb9c8 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xe pfn:0x599c2 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001a41648 ffff8880b85414b0 0000000000000000 raw: 000000000000000e 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 7257, tgid 7253 (syz.2.383), ts 169739507412, free_ts 169740156503 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490 folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1917 shmem_alloc_and_add_folio+0x371/0xd40 mm/shmem.c:1959 shmem_get_folio_gfp+0x6ad/0x1910 mm/shmem.c:2512 shmem_fault+0x1f9/0xa20 mm/shmem.c:2713 __do_fault+0x10b/0x440 mm/memory.c:5425 do_shared_fault mm/memory.c:5924 [inline] do_fault+0x2db/0x1750 mm/memory.c:5998 do_pte_missing mm/memory.c:4566 [inline] handle_pte_fault mm/memory.c:6379 [inline] __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6517 handle_mm_fault+0x37b/0xa30 mm/memory.c:6686 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x1178/0x32a0 mm/gup.c:1428 __get_user_pages_locked mm/gup.c:1752 [inline] get_user_pages_unlocked+0x30a/0x7d0 mm/gup.c:2681 hva_to_pfn_slow virt/kvm/kvm_main.c:2903 [inline] hva_to_pfn+0x871/0xd60 virt/kvm/kvm_main.c:2999 page last free pid 7257 tgid 7253 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 __folio_put+0x3b4/0x5f0 mm/swap.c:112 folio_put include/linux/mm.h:2124 [inline] put_page include/linux/mm.h:2193 [inline] kvm_release_page_clean virt/kvm/kvm_main.c:2813 [inline] kvm_release_page_clean+0x1dc/0x250 virt/kvm/kvm_main.c:2807 hva_to_pfn_retry virt/kvm/pfncache.c:246 [inline] __kvm_gpc_refresh+0x1a63/0x22d0 virt/kvm/pfncache.c:330 __kvm_gpc_activate+0x2ab/0x490 virt/kvm/pfncache.c:424 kvm_gpc_activate_hva+0x73/0xa0 virt/kvm/pfncache.c:444 kvm_xen_hvm_set_attr+0x395/0x16a0 arch/x86/kvm/xen.c:798 kvm_arch_vm_ioctl+0x2a0/0x18d0 arch/x86/kvm/x86.c:7514 kvm_vm_ioctl+0x1560/0x4180 virt/kvm/kvm_main.c:5381 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880599c2800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880599c2880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8880599c2900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880599c2980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880599c2a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================