Extracting prog: 6m44.19666255s
Minimizing prog: 34m44.904285658s
Simplifying prog options: 0s
Extracting C: 1m25.256453804s
Simplifying C: 24m17.685283914s


extracting reproducer from 45 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-clone$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0xffffffff, 0xe0, 0x15, r0, 0x7)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program did not crash
single: failed to extract reproducer
bisect: bisecting 45 programs with base timeout 30s
testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 28, 4, 4, 28, 28, 13, 12, 13, 13, 13, 29, 14, 29, 14, 14, 29, 14, 14, 14, 17, 29, 17, 17, 16, 16, 17, 16, 29, 16, 16, 17, 17, 17, 29, 17, 17, 17, 17, 17, 29, 16, 17, 29]
detailed listing:
executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
mq_open$auto(&(0x7f0000000000)='\xbe\xf2\x82\xe7\x14g\xb5\xeeMQ\x13\xa2_g\xbf\t\xfa\xf2_N\xb0{\xf9\xb57v\xeeG\xd9l\xbf\x86q w\x96\xd9\xe9\xa8\xe1\xf0\xc7\x1f\x1e\xc4\xc4\x89u\x83\xe8}\xbd\x7fO\x91\xc1UVW.\xb6\xad\x04u\x02w.\xec`O\xc1\x0e\x15\xe7:\xc9\x1bK\xcddY\x03\x95\xd1\xae\xc1\x9b\x96\x9faj\xd2\xfc\xfc\x1f7\xaf\xcan\xf6\xc0wK\xce\xe7Q\xae\xc9Hg\x01\xef\xda[\xe5\xa3\xa3%\'\x8f\xcf\x96X:\x04Dkt\x7f\xde\x80\x01\xddX\x91\x88\xa1\t\xc3\xf1\xfe[\x93$O8 b\xb4\x92\xf4\xbc\xc5\xb9\x989\xfcF\xec\xdc@\xdd\xdaeM\xe0U\xc8;\xf5\xe7$Q8\xd2\x87\xdd\xc5\x9d\xc5\xe8\xb5\xb5\xb8\xdfD\xd0\xe8t\x8aS\xaa\xbe\xaa\xba\x9e^0\x1a\xf8Y\xf5Jp\bu\xba\x98\x00\xf0H5\xa9u\x0e\xc4\x04\x13\xf58p\x9f\x11\xc07\xefS*|\xd87\x12\xd8\xce\xde0\xd82;\xcd\x18\r\xccI\x99\n\xd2\x86', 0xdd1, 0x8, 0x0)
mq_notify$auto(0x4, &(0x7f0000000040)={@sival_ptr=0x0, @inferred, 0x1})
mq_notify$auto(0x4, 0x0)
executing program 2:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/vm/dirty_background_bytes\x00', 0x202, 0x0)
read$auto(r0, 0x0, 0xb5)
executing program 2:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x0, 0x5, 0xa)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0)
fstat$auto(0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$auto_gtp(&(0x7f00000000c0), r0)
sendmsg$auto_GTP_CMD_NEWPDP(r0, 0x0, 0x0)
r1 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
fsconfig$auto(0xffffffffffffffff, 0x2000008, 0x0, &(0x7f0000000480)="ccbe28c7e6fe0387d2afa160a010b6c39491faf1347cc720f16fe22a75a19a49b4b7b21cb60cb72ef82f18b2ca9d92808dd8690cb7b3108470b62af49b47c67a58f6e64ee40e715cda689d56515de044d05bf33769eafb0d5f7369857173a386e14b31053c5be5d08cb8a15406fba232eee55f9747f936be8e511239e77695de1c3c173d025df63789b321c9c7584159424bb3c00baf3ccd83e2c84a2022dd4e86047c17ef46864eb29f5fc0bb4e02b02580f814325a", 0x0)
read$auto_ftrace_enable_fops_trace_events(r1, &(0x7f0000000200)=""/34, 0x22)
ioctl$auto(0x3, 0x40081271, 0x38)
write$auto(0x3, 0x0, 0xfdef)
mmap$auto(0x0, 0x580f, 0xffb, 0x8000000008011, 0x3, 0x0)
madvise$auto(0x0, 0x2003f0, 0x15)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
madvise$auto(0x0, 0xfffffffffff70001, 0x1)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x4, 0x3f, 0x7)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socket(0x2, 0x6, 0x0)
socket(0x1, 0x2, 0x0)
setsockopt$auto(0x2, 0x1, 0x50, &(0x7f0000000000)='\x00', 0x40)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
remap_file_pages$auto(0x6a25, 0x1000, 0x0, 0x3, 0x0)
executing program 2:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
timer_create$auto(0x8, &(0x7f0000000100)={@sival_int=0x3, @inferred, 0x1, @_sigev_thread={0x0, 0x0}}, 0x0)
timer_settime$auto(0x0, 0x9, &(0x7f00000000c0)={{0x4, 0x10007}, {0x9}}, 0x0)
timer_gettime$auto(0x0, 0x0)
executing program 2:
socket(0x2, 0x2, 0x0)
r0 = socket(0x2, 0x2, 0x0)
bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0xffff, @loopback}, 0x67)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
executing program 2:
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_mISDN_fops_timerdev(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
mq_getsetattr$auto(0x3, 0x0, 0x0)
r0 = openat$auto_stats_fops_(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
sendmsg$auto_TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000000100)=ANY=[@ANYBLOB="68130000", @ANYRES16, @ANYBLOB="00012bbd7000fbdbdf25070000000a01098033d6b2f24ee018e9b9855ea5a93da0dbf50b4b8d86d9c820adfd997126489bd2546bfcc6fbff50c3bf8d7f45d1ebb9d89021906d31e536c6c0c92f519a0c83aea385552794c7882697d5a21c4da79315acddceacb346ab83e89a1645955894eef5f3c2c35e3124caac9166412cacae4bffc75d40f06baba4de4dbe5513052f62def8033ecf0fe621bc7a7f715aee786d0f3181c875c3977947736c9579f2a8135c790800c6", @ANYRES32, @ANYBLOB="59000080196ac6b1f594343c4dc2d5eef775d2121d439c6cde3911f42e14dea873dc07df80b5c9c191ea9197af5a41b30d5154771d3aa6abf4f498dc46b03d453fad04d3d69c1f96fc9b50dbd135811b420500f4000000000000000000000501028090ad7e7c493399c9bdb07eab0d03c802000000bcb15977343e24015792742705e71447aa81a23cdbf4e082e6bf010f5ef7670f5470e766e6bd53d8ed8452c290a80750460290587d580bede006a1c8383ab532e16dcc7eb4de284f4e8fa1f60a760ace6a545c6994d2c88279d8f115b3d80c4e987920e69b02d08f85214cb693ab205b0fc92df8c19d6a9d2edb6c4e135183d735b6292a09eea9d7f9d1b607d7c103000000000000000216c14d51a0902458349f24d076023ddea031fb7a36da788838209ab2aa125768bc0f72037b5131b8e65d4bf2306d29853432cdbcb88a434aae6c8849d6274299e692fb08007300543339e00400da000800d800445c42", @ANYRES32, @ANYBLOB="0000002800038008005e00", @ANYRES32, @ANYBLOB="0800f000", @ANYRES32, @ANYRESOCT=r0, @ANYRES32, @ANYBLOB="99f3a10396e315e1f108b34d1f100980b046b622a9dd59042c88a5c2dece45bb172c8508000d00", @ANYRES8=r0, @ANYBLOB="b2c918b3bb0ae2ae692f37b0cc89efe01ad859093422ab8d8d2b0545096c2cd8770f8bc86e30fffe3bf8815d3e27d0861d843153a501a915dc04797ef6a74bbc8d1a81492a3aa181cd3f982327724208db82d67eaa280ac2d84376f52203020ec946cd31eedccc3d49cee968706b648329601fbfe13b55d2fe9c7ab3f612c1889397217f46650544f0b9512146f71219359823e63867c8c60ec770fc07086fbb4a459b1f3306eccb4a6fca61be5f419568da8dd975e5ef50cf2878d2d39850af73f30892db996792913712911d67d0b97e0ea6f2f17a2a9bd11eb1448fa4dd61ead2b246ef9beb447db0ae5cc49c3059b440c0a8e1be3d92fb065c8f6b6b7ce52668f797d14d5a587c63430e487bf4eed22f79d4412ca618fb78817dfab24209c53457ba5a4fedd01fcb1125a7edd63a90770e2808ee56c51057aa1149031bfaa68c74916addaa31188eebfc395693c1ffeddc137ee8942107bdf2b87e0c6be78fea89a26a1ce0837a25c1e0ce2e74f768f986a1393250242fa782755c663c44ee4ccfce983b70e69eb993265c548796feb3c023ea72b874384aa655ac0bff871c2f74d121bd2704ee5ca0d979ab5b42df22bdfe9d76db9672b19695942bfb6c3924cb8983a2f6e235f23815e090379542fcff6f3fe98bcf3fffabba10ec1ce92afda6d36cad64bb64f28ba0c587ef2244bb166a988fc87088bfe3fb117cd922e95e87fa9c54e56563cefa2ba43b5f93003c455ed941347507a62af3ab439fbf8a08a01308685f4450ad6c3e607eb10e8596a321664e46352d6a77b66f005d6d4a05c22a534485afc06f82924c150592eff6022e528f62a5211e90108c67d4468b17a0971d6096fd503f6dbf416eec86bfe9f3bec415aa6eae7f6acb4cfa07eb07f4c1f5d139318b1db104c19d2cec59c91fa074cf42514cea183889cda81015b17ffdeb5d8cf485b4d16dcdc7ee13db09f3ae1ef92b80ff476551c3dd7cba2589ad54acdb6ab425645c1a0601f8ae24cd58e4acc5d975f47fb0a52f28a218cb2c637b46d4442d7b889120f1b2220552824ee3df3a35737382d5ee93a835433a67dfdb4a70845b12e05221a15a521242fd7638fce08ba4b48edba0cec4f5ead28708ce21f741d3c6ad1937475b7cfc1dcd30fa918d3203316201f1fbe33de09ce038dd93bc5293c4e6dcc73c529f5a11ae0bada4e890d680b51cffedfdc8fa2bfbe68ed37bade7de09652cd88c8056a77505ece2c3c47992"], 0x1368}, 0x1, 0x0, 0x0, 0x80000}, 0x20000)
pwrite64$auto(0xc8, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00\x00\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t3\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\xfb\xba\xb2.$\'\x1e\x82\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/250, 0xfdf3, 0x39)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x20040, 0x0)
mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0008, 0x17)
unshare$auto(0x40000080)
mmap$auto(0x0, 0x2000d, 0x4000000000df, 0xeb1, 0x800000404, 0x8000)
ioperm$auto(0x7, 0x6, 0x2)
userfaultfd$auto(0x1)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
settimeofday$auto(0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
futex_waitv$auto(&(0x7f0000000780)={0x81, 0x8000000000000001, 0x14000}, 0x3, 0x401, &(0x7f00000007c0)={0x7ff, 0x9}, 0x6)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kmsg_fops_printk(0xffffffffffffff9c, 0x0, 0xa0100, 0x0)
lseek$auto(0x3, 0x0, 0x1)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
io_uring_setup$auto(0xffffffa8, &(0x7f0000000040)={0xc6, 0x8, 0xbdfe, 0x7ff, 0x101, 0x8, <r1=>0xffffffffffffffff, [0x4, 0x7, 0x187b], {0x7, 0x5, 0x5, 0x0, 0x7, 0x5, 0xdb, 0x2, 0xfffffffffffffff7}, {0x80000000, 0xbcd, 0x9, 0x7, 0x5f6, 0xff, 0xa, 0x9, 0xf}})
splice$auto(r0, &(0x7f0000000700)=0x8, r1, &(0x7f0000000740)=0x8000, 0x9, 0x9)
executing program 32:
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_mISDN_fops_timerdev(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
mq_getsetattr$auto(0x3, 0x0, 0x0)
r0 = openat$auto_stats_fops_(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
sendmsg$auto_TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000000100)=ANY=[@ANYBLOB="68130000", @ANYRES16, @ANYBLOB="00012bbd7000fbdbdf25070000000a01098033d6b2f24ee018e9b9855ea5a93da0dbf50b4b8d86d9c820adfd997126489bd2546bfcc6fbff50c3bf8d7f45d1ebb9d89021906d31e536c6c0c92f519a0c83aea385552794c7882697d5a21c4da79315acddceacb346ab83e89a1645955894eef5f3c2c35e3124caac9166412cacae4bffc75d40f06baba4de4dbe5513052f62def8033ecf0fe621bc7a7f715aee786d0f3181c875c3977947736c9579f2a8135c790800c6", @ANYRES32, @ANYBLOB="59000080196ac6b1f594343c4dc2d5eef775d2121d439c6cde3911f42e14dea873dc07df80b5c9c191ea9197af5a41b30d5154771d3aa6abf4f498dc46b03d453fad04d3d69c1f96fc9b50dbd135811b420500f4000000000000000000000501028090ad7e7c493399c9bdb07eab0d03c802000000bcb15977343e24015792742705e71447aa81a23cdbf4e082e6bf010f5ef7670f5470e766e6bd53d8ed8452c290a80750460290587d580bede006a1c8383ab532e16dcc7eb4de284f4e8fa1f60a760ace6a545c6994d2c88279d8f115b3d80c4e987920e69b02d08f85214cb693ab205b0fc92df8c19d6a9d2edb6c4e135183d735b6292a09eea9d7f9d1b607d7c103000000000000000216c14d51a0902458349f24d076023ddea031fb7a36da788838209ab2aa125768bc0f72037b5131b8e65d4bf2306d29853432cdbcb88a434aae6c8849d6274299e692fb08007300543339e00400da000800d800445c42", @ANYRES32, @ANYBLOB="0000002800038008005e00", @ANYRES32, @ANYBLOB="0800f000", @ANYRES32, @ANYRESOCT=r0, @ANYRES32, @ANYBLOB="99f3a10396e315e1f108b34d1f100980b046b622a9dd59042c88a5c2dece45bb172c8508000d00", @ANYRES8=r0, @ANYBLOB="b2c918b3bb0ae2ae692f37b0cc89efe01ad859093422ab8d8d2b0545096c2cd8770f8bc86e30fffe3bf8815d3e27d0861d843153a501a915dc04797ef6a74bbc8d1a81492a3aa181cd3f982327724208db82d67eaa280ac2d84376f52203020ec946cd31eedccc3d49cee968706b648329601fbfe13b55d2fe9c7ab3f612c1889397217f46650544f0b9512146f71219359823e63867c8c60ec770fc07086fbb4a459b1f3306eccb4a6fca61be5f419568da8dd975e5ef50cf2878d2d39850af73f30892db996792913712911d67d0b97e0ea6f2f17a2a9bd11eb1448fa4dd61ead2b246ef9beb447db0ae5cc49c3059b440c0a8e1be3d92fb065c8f6b6b7ce52668f797d14d5a587c63430e487bf4eed22f79d4412ca618fb78817dfab24209c53457ba5a4fedd01fcb1125a7edd63a90770e2808ee56c51057aa1149031bfaa68c74916addaa31188eebfc395693c1ffeddc137ee8942107bdf2b87e0c6be78fea89a26a1ce0837a25c1e0ce2e74f768f986a1393250242fa782755c663c44ee4ccfce983b70e69eb993265c548796feb3c023ea72b874384aa655ac0bff871c2f74d121bd2704ee5ca0d979ab5b42df22bdfe9d76db9672b19695942bfb6c3924cb8983a2f6e235f23815e090379542fcff6f3fe98bcf3fffabba10ec1ce92afda6d36cad64bb64f28ba0c587ef2244bb166a988fc87088bfe3fb117cd922e95e87fa9c54e56563cefa2ba43b5f93003c455ed941347507a62af3ab439fbf8a08a01308685f4450ad6c3e607eb10e8596a321664e46352d6a77b66f005d6d4a05c22a534485afc06f82924c150592eff6022e528f62a5211e90108c67d4468b17a0971d6096fd503f6dbf416eec86bfe9f3bec415aa6eae7f6acb4cfa07eb07f4c1f5d139318b1db104c19d2cec59c91fa074cf42514cea183889cda81015b17ffdeb5d8cf485b4d16dcdc7ee13db09f3ae1ef92b80ff476551c3dd7cba2589ad54acdb6ab425645c1a0601f8ae24cd58e4acc5d975f47fb0a52f28a218cb2c637b46d4442d7b889120f1b2220552824ee3df3a35737382d5ee93a835433a67dfdb4a70845b12e05221a15a521242fd7638fce08ba4b48edba0cec4f5ead28708ce21f741d3c6ad1937475b7cfc1dcd30fa918d3203316201f1fbe33de09ce038dd93bc5293c4e6dcc73c529f5a11ae0bada4e890d680b51cffedfdc8fa2bfbe68ed37bade7de09652cd88c8056a77505ece2c3c47992"], 0x1368}, 0x1, 0x0, 0x0, 0x80000}, 0x20000)
pwrite64$auto(0xc8, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRNM\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00\x00\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^B\xb8\xe4j\t3\xe4\x90\xcc\x9d\xc5\x0fo\x84\xf4\x89\v\xea\x1b\x95\xafQ;CL\"\x01@\x00\x00\x00\x00\f\x00\xc0\x13\xc8\xe2\xae\xf5\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8d\x81\x81O*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,8\x93\xba\x88\x93\x9d\xb6\x1a\x7f\xc0%\xb0\x83ROJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd6eWj\xdc\xac\x88\xf0\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\xfb\xba\xb2.$\'\x1e\x82\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00\x00\xff\xff\x00'/250, 0xfdf3, 0x39)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x20040, 0x0)
mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0008, 0x17)
unshare$auto(0x40000080)
mmap$auto(0x0, 0x2000d, 0x4000000000df, 0xeb1, 0x800000404, 0x8000)
ioperm$auto(0x7, 0x6, 0x2)
userfaultfd$auto(0x1)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
settimeofday$auto(0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
futex_waitv$auto(&(0x7f0000000780)={0x81, 0x8000000000000001, 0x14000}, 0x3, 0x401, &(0x7f00000007c0)={0x7ff, 0x9}, 0x6)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kmsg_fops_printk(0xffffffffffffff9c, 0x0, 0xa0100, 0x0)
lseek$auto(0x3, 0x0, 0x1)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
io_uring_setup$auto(0xffffffa8, &(0x7f0000000040)={0xc6, 0x8, 0xbdfe, 0x7ff, 0x101, 0x8, <r1=>0xffffffffffffffff, [0x4, 0x7, 0x187b], {0x7, 0x5, 0x5, 0x0, 0x7, 0x5, 0xdb, 0x2, 0xfffffffffffffff7}, {0x80000000, 0xbcd, 0x9, 0x7, 0x5f6, 0xff, 0xa, 0x9, 0xf}})
splice$auto(r0, &(0x7f0000000700)=0x8, r1, &(0x7f0000000740)=0x8000, 0x9, 0x9)
executing program 3:
socket(0x2, 0x3, 0xa)
syz_genetlink_get_family_id$auto_nfsd(0x0, 0xffffffffffffffff)
mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80802, 0x0)
r0 = socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @loopback}, 0x6a)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x5, 0x0, 0x1f, 0x9}, 0x800009}, 0x3, 0x20000000)
sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000)
sendto$auto(0x3, 0x0, 0x4000e3, 0xfd, 0x0, 0x403)
setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9)
sendmsg$auto_NFC_CMD_ENABLE_SE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x0)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x1, 0x0)
openat$auto_bm_status_operations_binfmt_misc(0xffffffffffffff9c, &(0x7f0000000280), 0x100, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$auto(0x1e, 0x3, 0xfffffffe, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0x2, 0x8000)
sendmsg$auto_SMC_NETLINK_ENABLE_HS_LIMITATION(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
write$auto(0x3, 0x0, 0x100085)
executing program 3:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/pci0000:00/waiting_for_supplier\x00', 0x80800, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(r0, r0, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video62\x00', 0x80a01, 0x0)
openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec4\x00', 0x101901, 0x0)
r1 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r0, 0xc0585611, r1)
executing program 3:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x1, 0x106)
socket(0xf, 0x3, 0x2)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000580)='/dev/audio\x00', 0x0, 0x0)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000200), 0x103001, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0xa2741, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/v4l-subdev3\x00', 0x169000, 0x0)
r1 = io_uring_setup$auto(0x1, 0x0)
ioctl$auto(r0, 0xc0585604, r1)
executing program 3:
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000540)='/dev/tty45\x00', 0x201, 0x0)
ioctl$auto_TIOCSTI2(r0, 0x5412, &(0x7f0000000000))
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x0)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x403, 0x8000)
read$auto(0x3, 0x0, 0x80)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/rose6/statistics/tx_window_errors\x00', 0x0, 0x0)
read$auto(r2, 0x0, 0x7)
write$auto(r1, 0x0, 0x9)
ioctl$auto_TIOCSTI2(r0, 0x5412, &(0x7f0000000100)="15")
executing program 3:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x0, 0x5, 0xa)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0)
r1 = syz_open_procfs$namespace(0x0, 0x0)
fstat$auto(r1, 0x0)
syz_genetlink_get_family_id$auto_gtp(&(0x7f00000000c0), r0)
sendmsg$auto_GTP_CMD_NEWPDP(r0, 0x0, 0x0)
r2 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
fsconfig$auto(0xffffffffffffffff, 0x2000008, 0x0, &(0x7f0000000480)="ccbe28c7e6fe0387d2afa160a010b6c39491faf1347cc720f16fe22a75a19a49b4b7b21cb60cb72ef82f18b2ca9d92808dd8690cb7b3108470b62af49b47c67a58f6e64ee40e715cda689d56515de044d05bf33769eafb0d5f7369857173a386e14b31053c5be5d08cb8a15406fba232eee55f9747f936be8e511239e77695de1c3c173d025df63789b321c9c7584159424bb3c00baf3ccd83e2c84a2022dd4e86047c17ef46864eb29f5fc0bb4e02b025", 0x0)
read$auto_ftrace_enable_fops_trace_events(r2, &(0x7f0000000200)=""/34, 0x22)
ioctl$auto(0x3, 0x40081271, 0x38)
write$auto(0x3, 0x0, 0xfdef)
mmap$auto(0x0, 0x580f, 0xffb, 0x8000000008011, 0x3, 0x0)
madvise$auto(0x0, 0x2003f0, 0x15)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
madvise$auto(0x0, 0xfffffffffff70001, 0x1)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x4, 0x3f, 0x7)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socket(0x2, 0x6, 0x0)
socket(0x1, 0x2, 0x0)
setsockopt$auto(0x2, 0x1, 0x50, &(0x7f0000000000)='\x00', 0x40)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
remap_file_pages$auto(0x6a25, 0x1000, 0x0, 0x3, 0x0)
executing program 4:
mmap$auto(0x0, 0x20009, 0x10000000000df, 0xeb2, 0x401, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x1, 0x0)
io_uring_setup$auto(0x6, 0x0)
connect$auto(0x3, &(0x7f00000018c0)=@in={0x2, 0x300, @loopback}, 0x55)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000080)='/dev/usbmon2\x00', 0x80000, 0x0)
setfsgid$auto(0xee01)
sendmsg$auto_NFC_CMD_STOP_POLL(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0}, 0x805)
move_pages$auto(0x0, 0x91, 0x0, 0x0, 0x0, 0x0)
r1 = socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
ppoll$auto(&(0x7f0000000000)={r1, 0x8, 0x6}, 0x7, 0x0, 0x0, 0x8)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x84c, 0x0, 0x9, 0x0, 0x3, 0x10b}, 0x800009}, 0x1, 0x20000000)
executing program 33:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x0, 0x5, 0xa)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0)
r1 = syz_open_procfs$namespace(0x0, 0x0)
fstat$auto(r1, 0x0)
syz_genetlink_get_family_id$auto_gtp(&(0x7f00000000c0), r0)
sendmsg$auto_GTP_CMD_NEWPDP(r0, 0x0, 0x0)
r2 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
fsconfig$auto(0xffffffffffffffff, 0x2000008, 0x0, &(0x7f0000000480)="ccbe28c7e6fe0387d2afa160a010b6c39491faf1347cc720f16fe22a75a19a49b4b7b21cb60cb72ef82f18b2ca9d92808dd8690cb7b3108470b62af49b47c67a58f6e64ee40e715cda689d56515de044d05bf33769eafb0d5f7369857173a386e14b31053c5be5d08cb8a15406fba232eee55f9747f936be8e511239e77695de1c3c173d025df63789b321c9c7584159424bb3c00baf3ccd83e2c84a2022dd4e86047c17ef46864eb29f5fc0bb4e02b025", 0x0)
read$auto_ftrace_enable_fops_trace_events(r2, &(0x7f0000000200)=""/34, 0x22)
ioctl$auto(0x3, 0x40081271, 0x38)
write$auto(0x3, 0x0, 0xfdef)
mmap$auto(0x0, 0x580f, 0xffb, 0x8000000008011, 0x3, 0x0)
madvise$auto(0x0, 0x2003f0, 0x15)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
madvise$auto(0x0, 0xfffffffffff70001, 0x1)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x4, 0x3f, 0x7)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socket(0x2, 0x6, 0x0)
socket(0x1, 0x2, 0x0)
setsockopt$auto(0x2, 0x1, 0x50, &(0x7f0000000000)='\x00', 0x40)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
remap_file_pages$auto(0x6a25, 0x1000, 0x0, 0x3, 0x0)
executing program 4:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x10, &(0x7f0000000000)={0x0, 0xd6c6}, 0x2, 0x0, 0xe, 0x4}, 0x3}, 0x200, 0xb07e)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22240, 0x155)
r0 = socket(0x2, 0x80802, 0x0)
setsockopt$auto(r0, 0x11, 0x67, 0x0, 0x8)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
connect$auto(0x3, &(0x7f0000000140)=@in={0x2, 0x0, @multicast1}, 0x55)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x5, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 4:
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, 0x0, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@HSR_A_IFINDEX={0xfc85}, @HSR_A_IF2_SEQ={0x6, 0x7, 0x8000}, @HSR_A_IFINDEX={0x8}, @HSR_A_NODE_ADDR_B={0xa}, @HSR_A_NODE_ADDR={0xa}, @HSR_A_NODE_ADDR={0xa, 0x1, @broadcast}, @HSR_A_IF1_SEQ={0x6, 0x6, 0xf}, @HSR_A_IF2_AGE={0x0, 0x4, 0x80000001}, @HSR_A_NODE_ADDR={0xa, 0x1, @multicast}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40080}, 0xc000)
close_range$auto(0x2, 0x8, 0x0)
read$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffffff, 0x0, 0x0)
socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
socket(0x10, 0x2, 0x0)
mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x1c1282, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r2=>0x0})
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082dbd7000fedbdf250300000008000400b70a0000060007000080000008000200", @ANYRES32=r2, @ANYBLOB="0a0005000180c200000e00000a0001000180c200000e00000a000100aaaaaaaaaa35000008000200", @ANYRES32=r2], 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 4:
r0 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x14, r0, 0x1, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x40)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x3, 0xff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r1 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r2 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/controlC2\x00', 0x0, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000040)=0x5)
r3 = socket(0xa, 0x5, 0x84)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00'})
read$auto(0x3, 0x0, 0x80)
r4 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snd/controlC2\x00', 0x80, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f00000002c0)={{@inferred, 0x5, 0x9, 0x1, "4941aa833e2fc65b6b3cf7cec76d6778ad8eac3cda35ba9c2b2d43eeb0dc59c8dd3500f11581916caa0d3053"}, 0x4, 0xfffffff9, 0x1, @inferred, @enumerated={0xffff, 0xffe, "4bd04167d52dbe3758dcb7641f58661870525adcaedaa5deaa336a58b7382f979a0ff0b3d9583c08610104000049d9f994ef5578e78507d4f25cd03a4c4b5700", 0x9, 0x3fd}, "6cc1888a6393f1b4285854c5368de438f8cc142ef6df1259b05ba1183bedbd31b642b4051bc7955610c61c329794e5311121c760cb8211c78e6947a99807bcc1"})
r5 = signalfd4$auto(0xffffffffffffffff, 0x0, 0xa, 0x1003ffe)
read$auto_l2cap_debugfs_fops_(r5, 0x0, 0x0)
mmap$auto(0xfff, 0x202000b, 0x9, 0x1002f5, r1, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
eventfd$auto(0x8c)
socket(0x10, 0x2, 0x4)
io_uring_setup$auto(0x6, 0x0)
io_uring_register$auto(0x2, 0x19, 0x0, 0x0)
clone$auto(0x7fff, 0x3ff, 0x0, 0x0, 0xf)
r6 = prctl$auto(0x7, 0x1, 0x4, 0x5, 0x7)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
fsconfig$auto_SHMEM_HUGE_DENY(r5, 0x0, &(0x7f0000000080)='+\x00', &(0x7f0000000400)="59b1c556f2e97b084f131cb6f50de9e68eb4641972ffa1072b3df6b00f70b937aa075d66b1d8a6ec11c10ca365b095d544c899f91da3b8118e207222b9c26b14c8160d0bec086d9bd8d3fee1cb0b35df5b9b7150079575720ccd26b13b52adcb2246865d637e0030ace7f9c28186eb10404167e972c5b2a3c943df04f19e5f965ea5b976f6307b1635c3d933f5e9d3df5a655c1226421c4e870202b6616464fe00af3c9904d083b793b3edc6eb78eb051ecd3655f0e8f46597ec620bc1db7f8c018beda427c929f0a38e3434727f5594d5dec01d96278c3b1b72c54d8c5d7ddb89c36020124bc04f7d38", 0xffffffffffffffff)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
poll$auto(&(0x7f0000000000)={r6, 0x6, 0x98ed}, 0x9, 0xcea)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x3, 0x2)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/pagemap\x00', 0x82840, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x1, 0x84)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
pipe$auto(0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
connect$auto(0x3, &(0x7f0000000140)=@in={0x2, 0x0, @multicast1}, 0x55)
sendmmsg$auto(0x3, 0x0, 0x7, 0x8)
executing program 4:
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000001d40), 0x40a40, 0x0)
mmap$auto(0x0, 0x3, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
ioctl$auto_TIOCVHANGUP2(0xffffffffffffffff, 0x5437, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
get_robust_list$auto(0x0, 0x0, 0x0)
madvise$auto(0x0, 0x3, 0x66)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
read$auto(r0, 0x0, 0x20)
close_range$auto(0x2, 0xa, 0x0)
r1 = io_uring_setup$auto(0x6, 0x0)
ioctl$auto_SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100))
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
executing program 34:
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000001d40), 0x40a40, 0x0)
mmap$auto(0x0, 0x3, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
ioctl$auto_TIOCVHANGUP2(0xffffffffffffffff, 0x5437, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
get_robust_list$auto(0x0, 0x0, 0x0)
madvise$auto(0x0, 0x3, 0x66)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
read$auto(r0, 0x0, 0x20)
close_range$auto(0x2, 0xa, 0x0)
r1 = io_uring_setup$auto(0x6, 0x0)
ioctl$auto_SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100))
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
executing program 1:
bpf$auto(0x5, &(0x7f0000000000)=@iter_create={0x15, 0x5}, 0x7)
socket(0x10, 0x3, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800)
fstat$auto(0xffffffffffffffff, &(0x7f0000000000)={0x5, 0x80000001, 0x0, 0x100, 0xee01, 0x0, 0x0, 0xffffffffffffff91, 0xfd3, 0x2, 0xec, 0x4, 0x80000000081, 0x8, 0x2, 0xfffffffffffffff8})
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r0 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000000), 0xc0402, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
r1 = setfsuid$auto(0xee01)
setresuid$auto(0x0, r1, 0x0)
msgctl$auto_MSG_INFO(0x6, 0xc, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x4, 0x4008)
r2 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r2, 0x0, 0x40000)
recvmmsg$auto(r2, 0x0, 0xfffffff9, 0x10, 0x0)
ioctl$auto_posix_clock_file_operations_posix_clock(r0, 0x40103d0b, 0x0)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xfffffffffffffffe, 0xffff7ffffffffffa, 0x4000000008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
mmap$auto(0x2000000, 0x400008, 0xdf, 0x9b72, 0x100000000002, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/pcm0p/oss\x00', 0x480, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x400008, 0x7, 0x91, 0x2, 0x8000)
mkdir$auto(&(0x7f0000000180)='}[,&*}\x00', 0x8001)
mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd.', 0xd, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x109482, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff02c}})
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_TIOCSWINSZ2(0xffffffffffffffff, 0x5414, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000003040)='/proc/self/io\x00', 0x440, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/9, 0x9)
io_uring_setup$auto(0x8, &(0x7f0000000140)={0x3ff, 0x3, 0x8, 0x10001, 0x12, 0xc05, 0xffffffffffffffff, [0x7ff, 0xfff, 0x8], {0x9, 0x1, 0x5, 0x0, 0x400, 0x0, 0x3fe0, 0x8, 0x1000000000e8}, {0x2, 0x100, 0x54f1, 0x0, 0x101, 0xff, 0x8d6, 0x4, 0x3}})
r1 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x60282, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
fstat$auto(0xffffffffffffffff, 0x0)
msgctl$auto_IPC_INFO(0x44, 0x3, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x2, 0x57e, 0xffff8001}, &(0x7f00000000c0)=0x6, &(0x7f0000000240)=0xff, 0x0, 0x9, 0x400, 0xfffffffffffffff9, 0x2, 0x18, 0x0, 0xfff8, @inferred=r1, @inferred=r1})
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, 0x0)
write$auto(r2, 0x0, 0x100082)
socket(0x23, 0x5, 0x80000000)
r3 = socket(0x18, 0x5, 0x2)
bind$auto(r3, &(0x7f0000000280)=@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6b)
executing program 1:
sysfs$auto(0x2, 0x10000000000002a, 0x0)
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r0, 0x0, 0x2404c004)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
adjtimex$auto(&(0x7f00000004c0)={0xf332b6e, 0x0, 0x0, 0xfffffffffffffffd, 0xd4, 0x1, 0x6, 0x0, 0x1, 0x368e, 0x2, {0x100000000, 0x10000}, 0x5, 0x6, 0xfffffffffffffffd, 0x1007ffd, 0x0, 0xfe, 0x81, 0xffffffffffff628e, 0xa747, 0xdeb1, 0x804})
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
stat$auto(&(0x7f0000000300)='./cgroup\x00', &(0x7f0000000340)={0x7, 0x8000, 0x6, 0x8001, 0xee00, 0xee01, 0x0, 0x187, 0x2, 0x8, 0x3, 0x5fd0, 0x7f, 0x6, 0xfff, 0x3, 0x1})
setsockopt$auto(0x3, 0x0, 0x13, 0xffffffffffffffff, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
ioctl$auto_KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000000)=0x3)
mmap$auto(0x9, 0x8, 0xdf, 0x9b72, 0x2, 0x3ff)
r3 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/015/001\x00', 0xa901, 0x0)
r4 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/rpc/nfs4.idtoname/channel\x00', 0x8f3b7a51b80ebd01, 0x0)
write$auto_proc_reg_file_ops_compat_inode(r4, 0x0, 0x0)
ioctl$auto_USBDEVFS_CONTROL32(r3, 0xc0105500, &(0x7f0000000080)={0x7a, 0x7d, 0x7, 0x4, 0x100, 0x7, 0xa})
executing program 5:
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x10, 0x2, 0x14)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x11, 0x80003, 0x300)
r0 = socket(0x11, 0x3, 0x9)
close_range$auto(0x2, 0x8, 0x0)
socket(0xa, 0x5, 0x0)
memfd_create$auto(0x0, 0x2)
socket(0xa, 0x2, 0x0)
openat$auto_ima_measure_policy_ops_ima_fs(0xffffffffffffff9c, &(0x7f0000000000), 0x48001, 0x0)
r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x202002, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r2 = socket(0x10, 0x2, 0x4)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r0, @ANYRES8=r1], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x8800)
write$auto(r2, &(0x7f0000000000)='-\x00', 0xfdef)
executing program 1:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80802, 0x0)
r0 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a)
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x40, 0x0)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x5, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
io_uring_setup$auto(0x2, 0x0)
rt_sigtimedwait$auto(0x0, 0x0, 0x0, 0x8)
getpid()
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
setsockopt$auto(0x3, 0x1, 0x41, 0x0, 0x88)
write$auto(0x3, 0x0, 0xffd8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0x3, 0x0, 0xfffffdef)
connect$auto(0x3, 0x0, 0x55)
executing program 5:
socket(0x2c, 0x3, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
io_uring_setup$auto(0x6, 0x0)
socket(0x1e, 0x1, 0x0)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/admmidi2\x00', 0x1, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/net/afs/rootcell\x00', 0x8eba8eb442f05cb1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x101401, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfsd.export/channel\x00', 0x8f3b7a51b8162d21, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x88)
openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/arch_status\x00', 0x8203, 0x0)
socketpair$auto(0x1e, 0x1, 0x0, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x2a401, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
executing program 6:
sendmsg$auto_NL802154_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2006c8c1}, 0x14)
socketpair$auto(0x101, 0x7, 0x1ff, &(0x7f0000000080)=0x200000)
mmap$auto(0x0, 0xffffffffffff9b0d, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x11, 0x3, 0x9)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
mmap$auto(0x0, 0x3, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0xffff8000, 0x80009, 0xb, 0x8000000008011, 0xffffffffffffffff, 0x9)
io_uring_setup$auto(0x1, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
close_range$auto(r0, 0x8, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x3ff, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f00000001c0)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x5, 0x0)
umount2$auto(&(0x7f0000000040)='.\x00', 0x4)
umount2$auto(&(0x7f0000000000)='.\x00', 0x4)
executing program 5:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/usbmon0\x00', 0x400, 0x0)
mmap$auto(0x0, 0x4000005, 0xfffffffffffffe01, 0x8051, 0x3, 0x10000000008000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0x2)
epoll_create$auto(0x4)
r0 = socket(0x2, 0x1, 0x100)
getsockopt$auto(r0, 0x0, 0x42, 0x0, &(0x7f00000000c0)=0x1e)
getsockopt$auto_SO_ERROR(r0, 0x6, 0x4, 0x0, 0x0)
getsockopt$auto(r0, 0x9, 0x1, 0x0, &(0x7f0000000040)=0x2)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41, 0x1}, 0x1}}, 0x66)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(r1, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x400}, 0x4}, 0xfff, 0xb07e)
executing program 5:
mmap$auto(0x0, 0x2020009, 0x3, 0xfffffffffffffffe, 0xffff7ffffffffffa, 0x4000000008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
mmap$auto(0x2000000, 0x400008, 0xdf, 0x9b72, 0x100000000002, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/pcm0p/oss\x00', 0x480, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x400008, 0x7, 0x91, 0x2, 0x8000)
mkdir$auto(&(0x7f0000000180)='}[,&*}\x00', 0x8001)
mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd.', 0xd, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x109482, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff02c}})
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_TIOCSWINSZ2(0xffffffffffffffff, 0x5414, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000003040)='/proc/self/io\x00', 0x440, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/9, 0x9)
io_uring_setup$auto(0x8, &(0x7f0000000140)={0x3ff, 0x3, 0x8, 0x10001, 0x12, 0xc05, 0xffffffffffffffff, [0x7ff, 0xfff, 0x8], {0x9, 0x1, 0x5, 0x0, 0x400, 0x0, 0x3fe0, 0x8, 0x1000000000e8}, {0x2, 0x100, 0x54f1, 0x0, 0x101, 0xff, 0x8d6, 0x4, 0x3}})
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x60282, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
fstat$auto(0xffffffffffffffff, &(0x7f0000000000)={0x5, 0x7fffffff, 0xffffffffffffffff, 0x100, 0x0, 0x0, 0x0, 0xffffffffffffff91, 0x8000fd0, 0x7ff, 0xef, 0x4, 0x80040000081, 0x8, 0x2, 0xfffffffffffffff8, 0x63})
msgctl$auto_IPC_INFO(0x44, 0x3, 0x0)
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0)
write$auto(r1, 0x0, 0x100082)
socket(0x23, 0x5, 0x80000000)
r2 = socket(0x18, 0x5, 0x2)
bind$auto(r2, &(0x7f0000000280)=@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6b)
executing program 6:
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x10, 0x2, 0x14)
r0 = socket(0x11, 0x3, 0x9)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x5, 0x0)
memfd_create$auto(0x0, 0x2)
socket(0xa, 0x2, 0x0)
openat$auto_ima_measure_policy_ops_ima_fs(0xffffffffffffff9c, &(0x7f0000000000), 0x48001, 0x0)
r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x202002, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r2 = socket(0x10, 0x2, 0x4)
close_range$auto(0x2, 0x8, 0x0)
socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r0, @ANYRES8=r1], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082)
write$auto(r2, &(0x7f0000000000)='-\x00', 0xfdef)
executing program 1:
openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socket(0x2, 0x3, 0xa)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0\x00', 0x20401, 0x0)
openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f00000032c0)='/dev/mtd0\x00', 0x22801, 0x0)
open(0x0, 0x4242, 0xe1d2b27bdc14aabc)
socket(0x1e, 0x2, 0x0)
open(0x0, 0x40440, 0x40)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$auto_dma_heap_fops_dma_heap(r0, 0xffffffffffdffe00, &(0x7f0000000140)=';')
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
r2 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r1, 0x541c, r2)
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="df250400000005000b002e00000060290fbdaa5beb3f468c54285321775058bb82cce35664517c72e243426fe6ca32a29624beca74ed1213744077be00a4eedad28b9d5d"], 0x1c}}, 0x4044820)
r2 = socket(0x10, 0x2, 0x0)
recvmmsg$auto(r2, &(0x7f0000000140)={{0x0, 0x4, 0x0, 0x5, 0x0, 0xe, 0x8}, 0x8}, 0x10a, 0x8, 0x0)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000180), r0)
r4 = socket(0xa, 0x2, 0x0)
setsockopt$auto(r4, 0x0, 0x30, 0x0, 0x568)
sendmsg$auto_ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="01002dbd7000ffdbdf00050004000700000400063c0a6c489d8494282300f60591dce2a1d604c55d3a581ff5af87c36a4e9333d937d33b977617f440e0336e9e10ab17ac0fbaedf10fe9c38ab6bccd8a4700af67d33cb40bf799da14d58071a96e8da61847ce9fa88838087bfccff21ee5ffbd71bcaaf8a94a07913656f000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0xc0)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
openat$auto_fops_atomic_t_(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/fail_page_alloc/times\x00', 0x2, 0x0)
socket(0x1d, 0x2, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x801, 0x100)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x3}, 0x55)
close_range$auto(0x2, 0x8, 0x0)
executing program 6:
r0 = socket(0x2, 0x5, 0x0)
mlockall$auto(0x7)
mmap$auto(0x0, 0x0, 0xdf, 0x19, r0, 0xffffffff)
move_pages$auto(0x0, 0xd0, 0x0, 0x0, 0x0, 0x2)
r1 = socket(0xa, 0x1, 0x84)
getsockopt$auto(r1, 0x84, 0x1c, 0x0, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
r2 = socket(0x5, 0x0, 0x0)
setsockopt$auto(r2, 0x29, 0x1f, &(0x7f0000000180)='!\xa4\xff\x00\x8a\xf0t\xaf\x82\xd7{\x98\xdd\xee\xc2f\xcaH\x90\xc57M\x87<<\n\xf2L\"Y\xa9\f\n\xbd?\xdd\b\xf7vu:\x00\xeaP\xa7=\xef\xc3\xdc\xf3=J\xf9\x9e\xd9\x02\xbb\xd3\xf8\xff*\xc2\xd8w\xe9\x00\x00\x01\x00h\xe2\x0f\x1b\x95L\xbf\xa5\xacH\"xV#\xc7e\x12\x83\xed\xc7\xc5\x9e\x84?\xfa=\f\xd8\x14\x00\x9fJl\xdd)i\x9f(#\xb7\xff:\x94\x8bd,\xb2\xfc\xde32\x87;\tx\xffM\x1f\x1d\xd8b\xa5\r\xb7v;\xfd\xa14M\xd3\x95\x86\x04\xd4\xda}\xcat}\x18K\x85\x9bBj\x8e\x95\xca\x87\xfe\x125\x154\x83\x94X,\xa4\xf3\xf6\xef\x1a\xb5iX\x99\xa1NO\xc5R\xc9\xc7\xd6\x8d?\x13\x9f\xaf\xf4\xbc\xa3j\xefQ\x7f\xc4\x86\xe8\xc6\xf8\xfe\x115\xd7\x89\x86\xc6T\x14\x00\x13\xb9mf\xc0\xc2%_N\xed\xa9\x02\xe5\x83\xa0\x01O%NHKp\xe0\xb3u\xdc\x8bb\xfa\xabD\x1d\x8a\x1e\xb4C\x05R\xdco\xa5\xce\xc9+\xf8\xf2X#', 0x1fe)
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$auto(0x3, 0x400454ca, 0x38)
socket(0x10, 0x2, 0x0)
open(&(0x7f0000000040)='./file0\x00', 0x149443, 0x0)
r3 = clone$auto(0x21, 0x8cd, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x8)
process_vm_readv$auto(r3, &(0x7f0000000040)={0x0, 0x8}, 0x4, &(0x7f00000000c0)={0x0, 0x100000000000002}, 0x6, 0x0)
mmap$auto(0x0, 0x20009, 0x10000000000df, 0xeb2, 0x401, 0x8000)
executing program 0:
r0 = open(&(0x7f0000000000)='./file0\x00', 0x4242, 0xe1d2b27bdc14aabc)
socket(0x1e, 0x1, 0x0)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/admmidi2\x00', 0x1, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/net/afs/rootcell\x00', 0x8eba8eb442f05cb1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x101401, 0x0)
move_pages$auto(0x0, 0x8000000000000001, 0x0, 0x0, 0x0, 0x6)
ioctl$auto_BLKTRACESETUP32(r0, 0xc0401273, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/net/rpc/auth.rpcsec.context/flush\x00', 0x8f3b7a51b8162d21, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x88)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/arch_status\x00', 0x8203, 0x0)
socketpair$auto(0x1e, 0x1, 0x0, 0x0)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x2a401, 0x0)
ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
executing program 5:
mmap$auto(0x0, 0x2020009, 0x3, 0xfffffffffffffffe, 0xffff7ffffffffffa, 0x4000000008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
mmap$auto(0x2000000, 0x400008, 0xdf, 0x9b72, 0x100000000002, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/pcm0p/oss\x00', 0x480, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x400008, 0x7, 0x91, 0x2, 0x8000)
mkdir$auto(&(0x7f0000000180)='}[,&*}\x00', 0x8001)
mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd.', 0xd, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x109482, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff02c}})
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_TIOCSWINSZ2(0xffffffffffffffff, 0x5414, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000003040)='/proc/self/io\x00', 0x440, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/9, 0x9)
io_uring_setup$auto(0x8, &(0x7f0000000140)={0x3ff, 0x3, 0x8, 0x10001, 0x12, 0xc05, 0xffffffffffffffff, [0x7ff, 0xfff, 0x8], {0x9, 0x1, 0x5, 0x0, 0x400, 0x0, 0x3fe0, 0x8, 0x1000000000e8}, {0x2, 0x100, 0x54f1, 0x0, 0x101, 0xff, 0x8d6, 0x4, 0x3}})
r1 = clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x60282, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
fstat$auto(0xffffffffffffffff, 0x0)
msgctl$auto_IPC_INFO(0x44, 0x3, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x2, 0x57e, 0xffff8001}, &(0x7f00000000c0)=0x6, &(0x7f0000000240)=0xff, 0x0, 0x9, 0x400, 0xfffffffffffffff9, 0x2, 0x18, 0x0, 0xfff8, @inferred=r1, @inferred=r1})
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, 0x0)
write$auto(r2, 0x0, 0x100082)
socket(0x23, 0x5, 0x80000000)
r3 = socket(0x18, 0x5, 0x2)
bind$auto(r3, &(0x7f0000000280)=@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6b)
executing program 1:
mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x1272, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r0 = socket(0x1d, 0x2, 0x7)
r1 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r2}, 0x6a)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', <r3=>0x0})
connect$auto(0x3, &(0x7f00000018c0)=@can={0x1d, r3}, 0x18)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xffcc}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket(0x1d, 0x2, 0x7)
r5 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r6=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, <r7=>r6}, 0x6a)
sendto$auto(r4, 0x0, 0xc, 0xfffffff8, &(0x7f0000000440)=@can={0x1d, r7}, 0x36)
executing program 0:
openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0)
openat$auto_vhci_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_vcs_fops_vc_screen(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x108002, 0x0)
epoll_create$auto(0x3e)
openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000000), 0x189a01, 0x0)
eventfd$auto(0x3)
socketpair$auto(0x9, 0x2, 0xb, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptyd9\x00', 0x0, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
ioctl$auto_TCFLSH2(r0, 0x800455cc, 0x0)
executing program 6:
mmap$auto(0x0, 0x9bc, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
socket(0xa, 0x1, 0x84)
socket(0x23, 0x80805, 0x0)
fanotify_init$auto(0x5, 0x2000000000002)
io_uring_setup$auto(0x3, 0x0)
pipe$auto(0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/vtconsole/vtcon1/bind\x00', 0x182b02, 0x0)
socket(0x2, 0x3, 0xa)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x2, 0x801, 0x106)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socket(0x15, 0x5, 0x0)
r1 = socket(0x10, 0x2, 0xc)
sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000013c0)=ANY=[@ANYBLOB="18000000", @ANYRES8=r1, @ANYRES8=r0, @ANYRES32], 0x18}, 0x1, 0x2000}, 0x80)
executing program 1:
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x23, 0x80805, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x6, 0x0)
clone$auto(0x400000000000007, 0x7fffffffffffffff, 0xffffffffffffffff, 0x0, 0x1)
keyctl$auto(0x200000000000020, 0xffffffffffffffff, 0x5, 0x5, 0x8)
move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000)
mmap$auto(0x0, 0x9, 0x2, 0x40eb2, 0x401, 0x300000000000)
move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000)
setrlimit$auto(0x8, 0x0)
mlockall$auto(0x7)
write$auto(0x3, 0x0, 0x81)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sysfs$auto(0x2, 0x100000000000036, 0x0)
fsopen$auto(0x0, 0x1)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
r0 = epoll_create$auto(0x4)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket(0x2, 0x5, 0x0)
close_range$auto(0x2, 0xa, 0x0)
open(0x0, 0x149443, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000380)='/sys/module/ima/parameters/ahash_bufsize\x00', 0x62, 0x0)
open(0x0, 0x181080, 0x118)
openat$auto_uhid_fops_uhid(0xffffffffffffff9c, 0x0, 0x2201, 0x0)
r2 = epoll_create$auto(0x100008)
epoll_ctl$auto(r2, 0x1, r1, 0x0)
r3 = epoll_create$auto(0x3e)
epoll_ctl$auto(r3, 0x1, r0, 0x0)
executing program 6:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x0, 0x5, 0xa)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0)
r1 = syz_open_procfs$namespace(0x0, 0x0)
fstat$auto(r1, 0x0)
syz_genetlink_get_family_id$auto_gtp(&(0x7f00000000c0), r0)
sendmsg$auto_GTP_CMD_NEWPDP(r0, 0x0, 0x0)
r2 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
fsconfig$auto(0xffffffffffffffff, 0x2000008, 0x0, &(0x7f0000000480)="ccbe28c7e6fe0387d2afa160a010b6c39491faf1347cc720f16fe22a75a19a49b4b7b21cb60cb72ef82f18b2ca9d92808dd8690cb7b3108470b62af49b47c67a58f6e64ee40e715cda689d56515de044d05bf33769eafb0d5f7369857173a386e14b31053c5be5d08cb8a15406fba232eee55f9747f936be8e511239e77695de1c3c173d025df63789b321c9c7584159424bb3c00baf3ccd83e2c84a2022dd4e86047c17ef46864eb29f5fc0bb4e02b02580f814", 0x0)
read$auto_ftrace_enable_fops_trace_events(r2, &(0x7f0000000200)=""/34, 0x22)
ioctl$auto(0x3, 0x40081271, 0x38)
write$auto(0x3, 0x0, 0xfdef)
mmap$auto(0x0, 0x580f, 0xffb, 0x8000000008011, 0x3, 0x0)
madvise$auto(0x0, 0x2003f0, 0x15)
mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000)
madvise$auto(0x0, 0xfffffffffff70001, 0x1)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x4, 0x3f, 0x7)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x0, 0xfffffffffffff000, 0x2)
socket(0x2, 0x6, 0x0)
socket(0x1, 0x2, 0x0)
setsockopt$auto(0x2, 0x1, 0x50, &(0x7f0000000000)='\x00', 0x40)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup$auto(0x6, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
remap_file_pages$auto(0x6a25, 0x1000, 0x0, 0x3, 0x0)
executing program 5:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0xffffffff, 0xe0, 0x15, r0, 0x7)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
executing program 0:
socket(0xa, 0x1, 0x100)
ioperm$auto(0x7, 0x5ad2, 0x8)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
socket(0x1e, 0x80001, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(r1, r1, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video62\x00', 0x80a01, 0x0)
openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec4\x00', 0x101901, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd6, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80000001, 0x7, 0x1, 0x9, 0x1, 0xfffffffffffffffe]}, 0x0)
write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xfffffffffffffffe, 0xffff7ffffffffffa, 0x4000000008000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
mmap$auto(0x2000000, 0x400008, 0xdf, 0x9b72, 0x100000000002, 0x8000)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/pcm0p/oss\x00', 0x480, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mmap$auto(0x0, 0x400008, 0x7, 0x91, 0x2, 0x8000)
mkdir$auto(&(0x7f0000000180)='}[,&*}\x00', 0x8001)
mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd.', 0xd, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x109482, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff02c}})
madvise$auto(0x0, 0xffffffffffff0005, 0x17)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_TIOCSWINSZ2(0xffffffffffffffff, 0x5414, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000003040)='/proc/self/io\x00', 0x440, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/9, 0x9)
io_uring_setup$auto(0x8, &(0x7f0000000140)={0x3ff, 0x3, 0x8, 0x10001, 0x12, 0xc05, 0xffffffffffffffff, [0x7ff, 0xfff, 0x8], {0x9, 0x1, 0x5, 0x0, 0x400, 0x0, 0x3fe0, 0x8, 0x1000000000e8}, {0x2, 0x100, 0x54f1, 0x0, 0x101, 0xff, 0x8d6, 0x4, 0x3}})
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x60282, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
fstat$auto(0xffffffffffffffff, &(0x7f0000000000)={0x5, 0x7fffffff, 0xffffffffffffffff, 0x100, 0x0, 0x0, 0x0, 0xffffffffffffff91, 0x8000fd0, 0x7ff, 0xef, 0x4, 0x80040000081, 0x8, 0x2, 0xfffffffffffffff8, 0x63})
msgctl$auto_IPC_INFO(0x44, 0x3, 0x0)
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0)
write$auto(r1, 0x0, 0x100082)
socket(0x23, 0x5, 0x80000000)
r2 = socket(0x18, 0x5, 0x2)
bind$auto(r2, &(0x7f0000000280)=@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6b)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-clone$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0xffffffff, 0xe0, 0x15, r0, 0x7)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
single: successfully extracted reproducer
found reproducer with 16 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-clone$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0xffffffff, 0xe0, 0x15, r0, 0x7)
openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-clone$auto-mmap$auto-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
mmap$auto(0x0, 0xffffffff, 0xe0, 0x15, r0, 0x7)
write$auto(0xffffffffffffffff, 0x0, 0xe)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-clone$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-write$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
write$auto(r0, &(0x7f0000000140)=')-+\xa2\x00', 0x6)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-sendmmsg$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x2, 0x0, 0x20000}, 0x4}, 0x1f8, 0xb07e)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-close_range$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r0, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socket$nl_generic-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
mmap$auto(0x0, 0x20000000009, 0xdf, 0x9b72, 0x2, 0x8000)
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xc8, 0x800454db, 0xffffffffffffffff)
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-openat$auto_safesetid_gid_file_fops_securityfs-ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
openat$auto_safesetid_gid_file_fops_securityfs(0xffffffffffffff9c, &(0x7f0000000000), 0x8202, 0x0)
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$auto_l2tp-ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
detailed listing:
executing program 0:
ioctl$auto(0xffffffffffffffff, 0x89a0, 0x8)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$auto(r0, 0x0, 0xe)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto-mmap$auto-socketpair$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
reproducing took 1h7m12.042702913s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline]
BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
Read of size 140 at addr ffffc90000ade000 by task kworker/u9:1/5142

CPU: 1 UID: 0 PID: 5142 Comm: kworker/u9:1 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: hci0 hci_devcd_rx
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 skb_put_data include/linux/skbuff.h:2752 [inline]
 hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
 hci_devcd_handle_pkt_abort net/bluetooth/coredump.c:298 [inline]
 hci_devcd_rx+0xa25/0x1780 net/bluetooth/coredump.c:367
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address ffffc90000ade000 belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc90000addf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000addf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000ade000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90000ade080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000ade100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline]
BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
Read of size 140 at addr ffffc90000ade000 by task kworker/u9:1/5142

CPU: 1 UID: 0 PID: 5142 Comm: kworker/u9:1 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: hci0 hci_devcd_rx
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 skb_put_data include/linux/skbuff.h:2752 [inline]
 hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
 hci_devcd_handle_pkt_abort net/bluetooth/coredump.c:298 [inline]
 hci_devcd_rx+0xa25/0x1780 net/bluetooth/coredump.c:367
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address ffffc90000ade000 belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc90000addf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000addf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000ade000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90000ade080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000ade100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================