Extracting prog: 11m50.152208771s Minimizing prog: 15m52.473597745s Simplifying prog options: 0s Extracting C: 1m26.488709823s Simplifying C: 11m13.164469172s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 20, 28, 29, 29, 2, 19, 11, 9, 4, 3, 16, 7, 6, 4, 12, 6, 10, 16, 6, 2, 2, 8, 4, 6, 6, 10, 4, 9, 9] detailed listing: executing program 0: sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) r0 = socket$inet(0x2, 0x3, 0x8) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) (async) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0), 0x0) (async) writev(r1, &(0x7f00000003c0), 0x0) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) getpid() (async) getpid() sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) (async) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f00000002c0)=0x6cd, 0x9, 0xc) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x40, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xffff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x65c9}]}]}, 0x40}}, 0x0) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x40, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xffff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x65c9}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000580)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) recvmmsg(r0, &(0x7f0000003800)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2000, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000440), 0xffffffffffffffff) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="15"], 0x15) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000001c80)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x8000001, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, '\x00', 0x1f}, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000800)='M', 0x1}], 0x1}}], 0x2, 0x931766f6319eed40) shutdown(r4, 0x1) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x5}, &(0x7f0000000140)=0x8) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_misc(r6, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000400)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r6, 0x404c534a, &(0x7f0000000040)={0x2, 0x1, 0xffffff89}) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000228bd7000fedbdf251c00000008000300030000000800030002000000080003000300000008000300070000000800030005000000080004000000000008000400ffffffff08210300060000000800040000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x240000c4}, 0x4) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/consoles\x00', 0x0, 0x0) executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x4000000000001ca, 0x4004010) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0x14a, 0x200080) ioctl$USBDEVFS_BULK(r2, 0xc0185502, &(0x7f0000000200)={{{0x7, 0x1}}, 0xa, 0x0, &(0x7f00000000c0)="fe579debc70e8a5f2795"}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socket(0x2b, 0x80801, 0x1) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @mcast2, 0x100}, {0xa, 0x0, 0x7, @mcast1, 0x29c}, r4}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @ib_path={0x0, r4}}, 0x20) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0x0, 0x0, 0x0, 0x4}, 0x94) madvise(&(0x7f0000570000/0x4000)=nil, 0x4000, 0x9) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) socket$xdp(0x2c, 0x3, 0x0) executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x7, @empty, 0x3}], 0x1c) r2 = syz_open_dev$vim2m(&(0x7f0000000580), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000001c0), 0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r6, 0x110, 0x3) connect$rxrpc(r6, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, 0x24) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) recvfrom(0xffffffffffffffff, &(0x7f00000030c0)=""/4117, 0xffffffffffffffbf, 0x1, 0x0, 0xffffffffffffffb5) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000002c0)={0x2, @pix_mp={0x0, 0x80000a, 0x31435641, 0x0, 0x9, [{}, {0x0, 0x202}, {}, {0x76e6}, {}, {}, {0x8, 0x2}, {0x0, 0x403ff}], 0x2}}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001580), 0x200, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r7, 0x3b83, &(0x7f0000001640)={0x28, 0x10000, 0x0, 0x0, 0x34c768, 0x7, 0x4, 0x1f6313}) executing program 0: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x50, 0xffffffffffffffff, 0x7cacd000) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000002e80), r0) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000002f80)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x20180001}, 0xc, &(0x7f0000002f40)={&(0x7f0000002ec0)={0x50, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8}, @GTPA_FAMILY={0x5, 0xd, 0x1a}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x25}}, @GTPA_PEER_ADDR6={0x14, 0xb, @dev={0xfe, 0x80, '\x00', 0x36}}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="9c"], 0x9c}, 0x1, 0xba01, 0x0, 0x20000000}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, 0x0, 0x6014) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x1a1040, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0x7000000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000080000000600000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000ffffffffbfffffff"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000fbffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x14200, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000002380)={'syztnl2\x00', &(0x7f0000002300)={'erspan0\x00', 0x0, 0x8000, 0x80, 0x0, 0x9, {{0x16, 0x4, 0x3, 0x3e, 0x58, 0x65, 0x0, 0x2, 0x29, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x3d}, {[@timestamp_prespec={0x44, 0x44, 0xf3, 0x3, 0x7, [{@remote, 0x9}, {@broadcast, 0xa3d}, {@empty, 0x7}, {@multicast1, 0xfffffffa}, {@broadcast, 0x7f}, {@loopback, 0x800}, {@private=0xa010100}, {@loopback, 0x3}]}]}}}}}) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmmsg$inet6(r6, &(0x7f0000002d00)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2a}, 0x101}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000200)="b601c594c667c8107c791f543bd7b1605b8a835463205816570efdd91a2347f7eb68e45c616d3b4d6696e0236f4e7d104e19d65388436daef0ed6f3d4503a90202fc7b5040fdc2aa965fa960db0ae59a0f83090af0d8c301d2be982b71d57f3b5bb10da4e9e86f7a6dbb7537ac11bd94014978cad56281830dcfe2fc9ec0db4fd4f06073b7ac5771b44e8e9a1d", 0x8d}, {&(0x7f00000002c0)="c6bd6e86e67424f5a7eadcfaab43b24e599b748b0fedb40147831f2b68923c47d08b9e8d4db50b61c1c6a8d843289d3577ed556bb525eabd164c3054aabe3a3185a8f60c18b09fe2d3f13d0c2e7c5d61888bb021bdc27a0aab11bb89db2e502c8e2134769b5a0fb710da8ad4ba303544400ecf5a2b06fb70853e", 0x7a}, {&(0x7f0000000340)="8d47a669321748bd8a017806aac300b2d6e4ca51acfea6212a87a96dcfb41ec6bc7fdc41cd5968fc2ea82af9885f1b9d97e9a681a1c456e3d68cddf9e0b876322f079e00e27adb977fdffca44de074d30416b82f3bc88c27d9985f7d8b9738d26a6b2ee67d81e74738c7a0c9a525c9ea5fc3b7df353c525c26621ca7cc285b165c54a19556d11f9a17b307c37a9f23f90fbf1500deb55cc23e95d91302d64e2f4963cdb59132c635b0b08ef7da8fb61d08857e0e4030e2fc026352aea84af01ff958c15507e36377f9abb94909dd63e230eae42b2fc90493551e33fd47f8183ded23615ee13af5d8da4165448cc6c78217d92828466f93045357e434c454", 0xfe}, {&(0x7f0000000580)="f96fc2ab1a59ed81e461141989386342e8cc953fd86bd7acbfd220f8ba04a7f6eec2d1b73149346411d723df7ec29b1df0cde03de0a093ae2e628547d3408dca1e119578dcce2749ee0521d16ab87595bdbda0c676404360905c75c3a11b4c85657243b28f2cad80f0ef6d7a64b15b1a625696cbdae35582862e36aac99517676f11d1b588c496cad5520a16096d5fbf5e569e11a6111c5dc14a666cda7a2edfaace980ae9a635853f6798ac2e4724af84bf7fc2361caea42b1e4a6c113cc7da9c86c7870b06447d85712191a5e9b1fa482cb1b57b9a10cf6b5f08d8a3fbb5fcaab1a199b6", 0xe5}], 0x4, &(0x7f0000000440)=[@rthdr={{0x78, 0x29, 0x39, {0x2f, 0xc, 0x2, 0x7, 0x0, [@private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x3e}, @private0, @private0]}}}], 0x78}}, {{&(0x7f00000004c0)={0xa, 0x4e23, 0x9, @mcast1, 0x6}, 0x1c, &(0x7f0000001a00)=[{&(0x7f0000000680)="f0ec497eef15b47bfaa2663f3d101c8d71c30f5e2064d207d522ba744313a96845bd3c26f0b70f34cb44d9960639c453f2304fb61e4159b15634295dbf22982a6edaf7a324f034d612fdad7fb696c6662c000df0b2950b6c9a23", 0x5a}, {&(0x7f0000000700)="c28d3c9d675e5f3818ed3e91fc59659746e1ad7f4598d9096197107fcee5bcf32fe400b28fdd6b3c00aa7e557644f4c47036fc", 0x33}, {&(0x7f0000000740)="7bbc03da682da69a2d3d4aedbb45059cde8282d516b2c4d62ed9a7fc9d0b7412ab8f57f678ee0e925ec8f42871edbfbdf00e2f99a2fb931bd363791ad537de3d6debe4a8d0c0ac6263c2f5cdbc9152457079407a8ec92a9188048ca84f63e1829f9e3e91df473aaa8cdabc7642d6a466b5588978b1ca4d14b449afa5eb71ca1571c55ea8b8cf52879a0391e202726b33d10a", 0x92}, {&(0x7f0000000800)="89ba84cf8dcd4c0daa2e89d166c923e6e08b17fa8fc13d6c49e0f3216d508a8d16670c4c3d3ee434485ea8d7e00591c785416033c789d653314a11a3698e6332b58928c9a09d7b02d25a25fe26af58309e2159cf2939622e32e4b7db8c998d459170bd533757e1401b14e6743717e4ff01dba47b9e8d054d630c9b633144c7703202f9a54447b74d7aa45b3af02994f273730e3c9bb4222b7cb543aab679fd2cfe2d752a0af63c4d20727e3cb3454b484726b2654075b5e1b0d46504f5f6ebec", 0xc0}, {&(0x7f0000000940)="84f567de7eb6da7ef626f4db8b5d348a9a61a8885e4c0e93243954ee0a979200c8671c61d23212206388c5d45b3ea7d6fe1800deffaad075c9389a1cf1c9846b3277a02adc868ddc90e9210a3e99c7b53214fa0043ab1f9cfe5eb2ba3f5c6f1eda5894aabe71a15742a34640963b8624f42ba798d42091dd97ed95818b6aeb809d44e317481640a831083c96395570fd6cdd4a06c0c00e8015b635e3237478b85f08ee8c545f829ad61de54ae479bace7d75d082501b12b70b656ceef6fdaf5b5b1164f4314e71fd4ef93db06293dad12c67d18355b4d9039352dd6725eecdd9a6837d62a170148f4d0c4d897dfae3ea695aeff7eedcfedebb3d5dc3a0be8c1a77d57771516c42502108cf5e1893e8735bcee223248353b90179fb0a8d4f346364415d4593d35eba237c30ccdd1829f0c9bc908e4e92f0022f922168cfef5a7b397733d615dee73e60aee16adc9e2ce72e28445cbb2ecbfe55d063b0d4692b50b9bfbd4a64252ebe3a3def91017906fcf997cfd68162d856b0cb1bf80ae3503a6da3d1930a9f3503a3f6954e51ddf286842f26e68ab34912b36cc7fc1ff3d9408a392957b0ee49dfe7ded91bc4ae8b724821455bd63452a30826a772614c86070bbb5904cbaec3ea9811f63473375de223e5e8b8267b5f1566dd5d7066ecbca372cae2d455afd9d72943ab0d0647479c03e0e5ab958527f01ce699921aeeb83621c03b2f1303c37216d2215cc47c6307b905dbc4d55d08a68166d03f911b8c8db7a2862f9dc8de8da92a0eed7e015e70ff196388c1481708709c7a5ccb0a8e53fbc0f9ddaec1112cb674dd6aaff5a1c0bbaf2c1486ea44ec335799ceb822bbb1dc9506c21396acc22449abee0d09f4c5b161471c9673b953f78f2cf928937ace6316f8a20993833bdf769f7737b1b94e536e81d13ddb14fe3b3d128617d54924fd2459036c1890d9fbd4770596e7a80c54853a6d03d08b483d9998187733cd66cbdccb04cc788c95474e663eaee7707a32b3542e255c8c5ad72d92819e5fb8fa2707fc31ce6724911da27496c5d7e92880bcd0a3946330ee8e5e27cf827e00a7a4f26d390a171ffd0d01317e0cd5bc35acf2438b4a25baced782c1185a73d8bf191ef90c12465a579fbf1732d36cedb9f58926dbe477cc72e0869133dc4bda04f47c7b04f9d6d76514be26f856aff5f7adeab7e7baac9fcd6a13377d283b10189533207e81c93a66f402b5b161a195177fbfb82b45664fae3c1f54393d426d58070fa6daf0f42edccf275c09115284438bf4a44735f995b2cd00de6f66922cf3c5864497af251975ac1ca7ef2444bd774c418015313716e5aa5f844b6fc13862cb11cf9f92318ec6862c2a9a927e30c6fe9ab34d66a5ce3d6063477121fe22dd1e04465ecd5b602f516c7be35f90e53c294eed86e51879d7fee49e948a9e177462aa148192de4317cd6879eb7e0ef148c8ea4d436e5dbb2724b57492ca92ddc8f105f60e3a0e0f52dfcdb63450b756fba402d61f88725bc034fc2f7e1f90106083d85d7b8bbe4ff6b68b93987b23e7dee5d928108a20c6f34bae5041e60fe517b8e91acbea7d1fb6a08c70fcfa8c43ca1d70f7f5dc8a70bccdc44247cdee2f4db906ef56f424f3f8d84a0dd23a9cb36c716a98682307fd9f7949842714a0a57f0384d1520946264b26ab6a8e640752e8a2f29bcb81f4114dcc46ea6011e0f5990d530493acdef93a2f564e92546387e9c4132e65134c858655b325532e0d4d94ddf73dbce0e9e0aeb300da7f23db4d764c9fd58439e2599b6d63f393b9a9b5e3608351599e75f175ac75ea357b33ab6bf99d1717511d2781b06680f11e4b74bc2594ee1abcfaf203768af3227a3a0d107b45341c6bc769e680724f559308b27e03a033a486ac047962a893f45609b8911c537cf2dfbbaddd54dd5a16177bcb8cd052123327aa1ed3f57d2c5d17a3459109fc7565f0a54cf73861a4ca6fd24b5ce8177d0a3c36e1107be5f716b3baa725d6dfe2d3cdc096d37e6a7de91d15a0a7e9ed6f913ffb6c125da042dbd60a98536abb6c8cffa914905f5d2993c97520e71bc3711d95bb5a065082f84c02a7f77459c57e49f9fb8c355a838f8cd5c1bc8ef96bee1e59412854aeb2bd37a5b251d988813e72b6769baeae916f40114fcf12fd913785aa535706b8155218d776200124e1988390b55a9cd431c059f7b495767dc93caa49dfe4adaedb0013704f127357d9e154bf8b385366befb15219c182b14c2a40277cbf7ba53fb56afe67945dcccf02718bd0084025d013c1d936d7d1b3b31d40ed023d37a45cec8d82408c494761e968090e3d142886a10f6eff46b3697ff0ab07300f82bc5ee95f482c6ceef5ebf37057d98f7150caa6316a6c31a2bfe345b6d911cb64c5e1202f80c05f3868011fdfab205efb8c0aee128eabc21503d848657091f5fb41ccf5a23200c403e5813b84da7057727cb92c9c53a32f4b17b481c736dedf4657f6755c928882e2ef991d3112556e1a29e32d9d2d84b32545e5ad447b9dcc2c159191fd44863387205985cb879bca1244ca27664f9cc102e55287545628af089f322c415bc7e9d5989ab2e4ff6ce663a61d42f2f21bde3ef6a9496c23e9f39eb53413d1ff06e1264cbea47dde5d167641e468f0f589b5da65f1d49c68daf7530784837b8503ed977b85348262cf8a484e0c6c0e62499c5e9286538527b83e648cd7c8d8a31fc04e77ccc1c7577dce6789e144429fd3444d1909263beb282115abea09fb9205f54377e7a273b293efa0b29b9281974d892c4d8934425a4d0d9e535ed0bf8cb304e2a4cb2ea77fd55169715c19ac9f56b692855d61ef4838815f30cc3a97c7fe258cb915d1ce93304c173cffd5073dec92f171b6922120c92683e42e00db0dc709e9d10cbe6d4f0cd6d211f82ade949694b543576b6f174d4c2f1a645ef790bf04169f3d4726e40eebf4a0d82af99d7780d96c578c988911f2214ec1e0bd4e272976c71a9074c38d94ee77dc2824f6ec0810ff5026ff1313dd71f7a715f6685799d8287f8a1da7be84b4a6239a12e6ce6b55741f4fd920610a5535fe1da3036360c1cc20ab9f7ddb3d74d06c891ae27492719aa20ce93416e973a74f4c32aa3421010c2b8aa21be36856f5bfbbd32279d7a90685389f75ffcb83fdaf2914d22386c09e26e14d5087612624f46e4faec3767e62a57625d77f581db86abb61c90c45bc8e78ddb9b8c7b9e229d70da4f409a0d5600eccbad06ea511f86d2f65d79d24fb0291863d418fc4a29ec2409f86dfdc1db229723f0f34f818af179a5cdf68aa7a468eec35df7ecfc8e846f0a29ab00a2bcb21047e05c35543fb2634cd72105a606289889efdf72c1c147c6f0e42014c7f5c645f1c029fa9ba7019d97cab2a73286a852bbe9add26124c2f0d5583296a7f2abfc3d03646b713f6d264f5dac0a403f026f44f4606c4b07278f10fbee192676b158ccf897169f2a8f44e7821d3aaef303f1feb364a8d3b58103041bc500e8702e0b7f38d03367fdb792b30e70011532e3b179b5ef048099069ad9b5e6e721956e1bc19059efbedfdedcd016f7f11ee3b246cdd93a5e6e20f0cad4b351d495ec5b4b4b8d1d9ed55dc23c2afaaf95d28cd02728f4ec00f67bd8aeeb6a350b9627446e3d07a4f1e18017f81cd428bc270d8e0c0f20460ae7964c8b439b3960b2fd7a86e347e60ddf09522dec8a0b03cb331acefa7ae41da8233c03d62ba0511dc16f4aab968147b104a15577cd55beb2d7c0ad1ae18d971bbb2aae86e134fdfc68fd5f442fbd70c30769b169e14973ff9bc71d6b7ef224b67fc11cbf26d6b9a005b7ccf8d613838137263363f26d85859820b8a405d2e5fe1ced119356429e4aa3f572e330f03cc74d27e0698a9463826f68cfe6fb201c7ec93758c120f425585627e14480c69557e07ae0cb0fecf203e4a027129e44303dc5a86f8af8601f0ac90480d90e48d199e315b4f478f561e557a4056c09c4a30d3158806f529829253adf591f87f0a540d06d6afc0da3a21479965843467db75330c6fbf2090b8fa25265f06a8616c8e66d4102a7d45f94289a8a552170c285307d792c7d2d24185acb20e57c0065363d2ef5326150fef00146dad31fc392cc719e28aa4de4ca169ad46fe39d0d310e210c35cf7c7d6bdba16457c0bd3b1cb9fe477774db15e1eb2fb2ab0efdc7b3466368e20ef3e02c7cc0c89e40bcd748d544c8fe17178307357a4cdd1178ceff6e8cffb985dc46fe7525f3f5b15c90025161893dfd389c203c562d6ca6d34b67925bebef86b66d2a34645bc66bd5a4ec119d7e6f8bdcba281369b43c6d20a9b4e35bcd0a90f1a8320e120eba02343eb61c871ae719d0ba78ddd21463243e3d3d2ca0c5c30b8edf53ae5c09ec590f0f8b713e476b4620e2f5c437829457e89d363c97310c9711eafb2a73549832caa4e584e8d73816b5f9a9f58084e6d5e33f0e97e2f2baa4272cc2f7a42bf248da68015bb116dde19d965b951846b418dac4b5734c8896457f76a0f22429e17e03e31819a56d98796bb5dd1ed81cea3a08a349fbc3507564fee618ad1f4980a589e2e45b6a9f6cb93a9431493e301349d63d1ffadae61d75e46c42b90c3bf9f8f305651b29b7ae40661043fade22523ae01900c659cb3ba7de820f20d71d4bd724c56f1d111d07aeac8d27cb3a1b27bf42e8276d49c3b1d37d4a3faeab896ce172f28fb2ff49de9de734467cb208809d33257a7e69affb51a3641efa4d3be44a1f5e59bbf5d71e852c8205ab0583ea30d9d5a4e251b92836550dd4f8a9d7aaa7f52ccd74013fa19790710906f477d5724013767e68fd8b2d8eab5a8e4d258953dea8e21cc83a7229f6bf56e832848411d0cb0d422c1f80d9ef4039700eae9ef85f587b08a31384894f8b05434489194b0519abfe86e770404dcb4906b863720caacb2979783c7df29223ff72783f2ffca6ee19228a5fd2cd09388533901803320d6909909802916b5aaf82dd8e7c1e9605241487285f872abed1ece55e35e30f75fdd3ff0ed13f16bcc06d3fd2822c489fd70cd286f42bfb8fd809e894d85ce3968bbe6c3647dbc856857fbafa899ae5b071601cb2b9cebbe4e5a96b70a8b9dd2e3577db08a7ac34edc3a07428bae1b79586f1b4a6e55dd4f256b76a06ccefc0d5c6e64261c14404f17e203eade544ca51aa0f29410bd0933fc2801c14ae7a0ab1f72ffe984f175be707892da3b149c8901cd583e18c460109496eb2f21ede94205b3c4c8a9766a0bbe40570f3a30687969594133ab0ab96734ab67998ddbbe4f0ea9e93d5bffd2639f6c1ca8a9f38564cb9630c6c33e1a41e551aa49d6b870965a74acb386741706465cd9d794531def6c2dc56192e4810e1fba1a7066ffb21791e3ebaf5c0d8f2df9befc402486febb3bff8965083363efdd56d8d895227b52b84337671f2ad6690c1214818a7213321b685985253bdbf35993e8cf5f3818eeb158d89d360fa34cb27e0878dc2e29af62ffcd0a7434f8ab6fce378927392067d04a403d1ae940a611a21f2862e8b31a9fd3330061294c24f312cccc81ac7b6bce15d0f7220a9b8c7853f3224954cad2f2b7699ad93a0bac00601d76887fb6927e9d8ca5bff1172840ff57335dc4fb869c53e8e06b2cebbae90ddae489e4bfcb4630a9653db483b087c50aaf16e4ffcf76768069161ec8cd194850ef014f317fe2fd52c46df5cd764743d4c29227c58d572ea76eab84030b09dd6dc4c183d903772cb806a9eb8979ce73fe53020", 0x1000}, {&(0x7f00000008c0)="251cc4a1650025be29a2a82874551ab6dc3871d3cd75c862fc47e5ccb84fcda445a6bdd644c0b69e15f5b1611cda2f9c2b471d9be4bf186eb876cc", 0x3b}, {&(0x7f0000001940)="87b3ff9db5e95a8bb806b70d3fbd71d15897ca2e0aa2e65a0b4a243bb6fabebc31de8ad62af7fda923e26b03b6cae21222bc67696a77e1dbeb47ceeb265663ff77281dfd10c940db8d9e71f1afdade727be3a6077e4159c78d7e617a2a914a3f91ef189e7eb0b9d404c93b79fc3f259c247e50089f4f4bb7bf39cece8a948d699da6c38c4ca2236f87", 0x89}], 0x7}}, {{&(0x7f0000001a80)={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c, &(0x7f0000001ec0)=[{&(0x7f0000001ac0)="2f6b07b79db311bf740d5059fc15b60ec980529fd326cc85053015342be15260d7c3ec04abeada", 0x27}, {&(0x7f0000001b00)="9f8b3a1c7ff42d4860caa1d319e8a4a4b472941d7da1e55054c2b475ee10de2517b4241c6cb26ff792fbd1f17881604ce3f4a014105f7d3c033503a5f1ba9276c14d6b54f57c0f872c5d841790617f8dd82457e0b7b1c4092273e8b61100481da46339e504b41b5eec1634d84100bcbe35a11184865ae119d7f1ea8db5a7d071c375a7b5", 0x84}, {&(0x7f0000001bc0)="72bd7969aadf77aec290e47e8a62d90d9d2350bd95941b6f2d44c3361feb2e002acb564622b2810eb2e40d06f0669a96a45c44267e04d3ff6c4cdb360d3ebabef9a619a82d6ac11395f6637cda953229b0bca3036d0c9e0db5ca00647416465d0cbbbf2163f2a0c527db0c078df2655668cb4e53373062d8e179513ca832fc", 0x7f}, {&(0x7f0000001c40)="e8fc1252e04a53702b5ccea18ee5413b78c9d0", 0x13}, {&(0x7f0000001c80)="84018cd7095bcaca08cdac97276065fb97654865c1f248fe8734223244bcf9ebfe047b908753f58f9df7037128c2b6", 0x2f}, {&(0x7f0000001cc0)="e70b95f69ea583dd4613614f01344d03a18754289d7d7d58f0182d5dcfd78ddd5b024edab61538391bb25f1f5f9ca07d4d0fc9fb5363f5a35fa4ea2a6b902bfc7b7b5fc3bdb6f043151033d9ea19951d9c2fa2c518d3cb59552e476cbf126dd668a5a122a1f8e33ded12ad8b1cf9ef8ecf55d5dc8cf0", 0x76}, {&(0x7f0000001d40)="6d437b149d3f47da79a8ffee959c6c21fd4e35e9026d5d83e1dd54bfc473ef4d931c0c8b4fc68acfc9a0ee128682a9e03e716b92f010de9b46d65b7cf9e3d168f417c47c05fc500050c4419755bdbd14dd24785436f30f44bfb88fca4e1f1ebfac9c835efebd6467ada9308b35d1bf6b60a9e7d5724cf1625d1bcfbcc850270849fec9c22a0133305de3e82ab97ba2a2ee4be2b53afb82b0038b8923e6054e7e192d49f4a6e9bf97be04f50eeed1400d65063e3cf4ef4102786e0149ada7330a0d2be080ac7f951d612028788f672ba70495a4bc", 0xd4}, {&(0x7f0000002fc0)="68d070dcd345e24dc82ca1955978f2ba757de6548a21f53f410c4047b5dcb7d00f4daa563effe4f971c554ae47da2e919f54db2fbda6c8eb8e6122ea4c8560b4ef90f8a17e605215d5ccddc5e4ac9351db0d44b6625ce7c4ace327377bb8948ac0efb4ceee3d51d9ef02f1f37944d41ee48bac71f2205528", 0x78}], 0x8, &(0x7f0000001f40)=[@rthdr_2292={{0x58, 0x29, 0x39, {0x3c, 0x8, 0x1, 0x9, 0x0, [@mcast2, @dev={0xfe, 0x80, '\x00', 0x41}, @empty, @dev={0xfe, 0x80, '\x00', 0x2c}]}}}, @rthdr_2292={{0xb8, 0x29, 0x39, {0x2, 0x14, 0x2, 0xe, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0xd}, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, @private0, @empty, @private2, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, @empty]}}}, @dstopts_2292={{0x40, 0x29, 0x4, {0x6c, 0x4, '\x00', [@pad1, @jumbo={0xc2, 0x4, 0x3}, @padn={0x1, 0x2, [0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x7}, @enc_lim={0x4, 0x1, 0x6}, @pad1, @ra={0x5, 0x2, 0xe}, @ra={0x5, 0x2, 0xfdc}, @enc_lim={0x4, 0x1, 0x5}]}}}, @hopopts={{0x58, 0x29, 0x36, {0x73, 0x7, '\x00', [@enc_lim={0x4, 0x1, 0x33}, @hao={0xc9, 0x10, @empty}, @pad1, @pad1, @hao={0xc9, 0x10, @empty}, @generic={0x0, 0xf, "1f42ba13d25e28616b763800abd0e5"}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x81}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}], 0x1d8}}, {{&(0x7f0000002140)={0xa, 0x4e21, 0xfffffffc, @remote, 0xe}, 0x1c, &(0x7f00000022c0)=[{&(0x7f0000002180)="7ed35c8a2db63df2f34fe74ae88efc30621156c7d17b3feb9d8e0dec69d2a473b9683962ecc429953a620d8803312b512f0d7d159cfd1dd4b47631e8f946b038697313ae2d6a58573e38438a579e998769cad7761041d1d0523ae43abddaea9fcf4bcc7a0af5fd939304f6669ef4a3a3341a2736f72de042c32d95632018eee697", 0x81}, {&(0x7f0000002240)="8e84e129b4d1207236dd0f2340d1a50491d628de801c9bdf86c5bc95c293277f50f9eb1364198c4ecdb2e158098ddfcf34b8285ae9b27c85fb36093c0f87eaf687a5a1438f737149b365135245bfb572a348874c5eada6040e84bc8b415f710e13aa430dd6b16560", 0x68}], 0x2, &(0x7f00000023c0)=[@rthdrdstopts={{0xc0, 0x29, 0x37, {0x2e, 0x15, '\x00', [@generic={0x94, 0xa0, "2b26fb3abd6d94c79efe3fd1333eae68d25e7e806cf849333b04c402b99e4adab85055accbec05404bd5e81afa71f84fe926df2ad7528bb824af92e9b820bb49d18cde67b2d3e9b17a5add7c4b21bd7c20d57096f1163b7f76b4fb1fe15e883c38b915c8e931d4c145b4290edcbf754c403eecd032ece48c7fc8dfb7767cb232b41ab832ce93218aa8ba7e9076a50c3a82c8e97351a60ee2ef62353cf3a6ebe8"}, @pad1, @enc_lim={0x4, 0x1, 0xf7}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}, r7}}}, @hoplimit={{0x14, 0x29, 0x34, 0x6}}, @hopopts={{0x18, 0x29, 0x36, {0x87}}}, @flowinfo={{0x14, 0x29, 0xb, 0xfffffff8}}, @dstopts_2292={{0x380, 0x29, 0x4, {0x3b, 0x6c, '\x00', [@generic={0x9, 0xfc, "b24f79de86a32bb1fac826479908cb10e3c8acc0afc9b6b54fa34898bb91b3c440ae0e7f4e31f553cba8e546257abad3d57a10b5bfa7707fc6f4093115048673187f8ef7b1bec44111820830842b5a2595c356d40f1fbe7d7bdb1a0c3079ff9e1e09ad97509184d3fa2e70c1257522c6004d3d86121811a25700a0d8aea96d401bdbed141d78af3cdcf174ab64494b97f41eada773a67e976dc1657370f51933d041836e5da73323bea7ae0a81b41b0aceb7bbc7095f47af80b22215594768cb3ba1cd5ce44a3771d2ba4d6e5055603bb5755c6c103c79b91a7f8be860b56b17fe73899a36fa64b9f064a17a8db92b08e65a3471ef572b6f1f1d1846"}, @generic={0x3, 0xec, "79eae8ab567c0d161b37b84c186eaa9f630466cd030486804bf62bf184319e127d4c8d3169883855c2f3990dffe5fd2b2f54bfc7e76a07275cfb20999c325eb6486fd4705ab19bb64fe63f1362338ecbcf359e8ef72ef60f87f963e3d1a147f50aefc7518d109d65c3c6ae0976432a442f5f3a04d67a081060245ab1156dec356ee6500d35594e316ba146d74cffc7c031ce698c9eb1087e3a67953a6bb9ae06966ec24118ef4b5c7b52f6253c495823ac64adc038e0aeacb1f66ba645078223cf46d58e69cf3cc5ecfcd3a6aff6bc98c6bb283c1481649248ec356726dfcf0833b6ef81e035db73fb065d7c"}, @generic={0x80, 0xc8, "d887740ce23274907deeaf20155650913387d05ba0d7a8dae325d9289db17658cd3af70bb1f6f8e3b448f21ee1dd90206acf9ec6ea1d40b86ca0ae11a64810014265c8cf1cc741b9cb858f03da57e69bcc75928d1d99aab5aef3f84948fa65783080fd8581043bc5b2ad6c5272604f88bf543da88fc574c6994d07a5d4a57da131583621547a73492552aa9360558ed07e604f35dbdf2e87907da1f51656cfd4296380477027b9efcc8dbf72ef93ab9d20ba380266c1bad02f0f8316b62d40bdf40a578cf5519444"}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @jumbo={0xc2, 0x4, 0x7fffffff}, @generic={0x3, 0x92, "440836e75778e5696f1573956a13c18ae4d0b63e6a651805f610f79137cc5c448c777cda3586efa19b4fe4f11f914db20e5444e17ad7d76f8691f6c0fe3d424738b5b9805c05d044569d29a309a2e47bb181be73d42349121ba948601231ae5811b4035b5a96aaa0f6b8fe7c56343e2cf53be40c0a010165e3df558847cf271400f77e5b05c606b9e4bb22b7e1f0d21c9b6d"}]}}}], 0x4b0}}, {{0x0, 0x0, &(0x7f0000002a00)=[{&(0x7f0000002880)="479b353dcd1caa70521070b84064540e40a034d48149a665abcb5432050e06da871b29bb617959475081fe52283cf9d8a6bc4b56747c60e547c611ca86b1806fdfb36686838aec7d985df4107d8bd9932f42326649935c18251a72dd08bb515a59cd1e3bfec8d76f8a264fae42bffcc377b1952cd82e9f93c8b3ef86f58cd2339bdbb7b96d", 0x85}, {&(0x7f0000002940)="4b159e1fca0916218430778ccca3850a4b23e63f1b4d763afd17a1da175cdaa6d5bab9f2a1b3b8861c388761674445c56b08fc8f0ec6d40d094399fd49b898a013783de6afe9a4ada463957dc838107e61456bf2dd3acc8614f1be5cf9c7c024122f829824d2d988daefc288fcd84c16c3210cd4ab97fa8d893f5cfa60bbd3f7f5c30a95a84c1e1c7d", 0x89}], 0x2, &(0x7f0000002a40)=[@dstopts_2292={{0x70, 0x29, 0x4, {0x2c, 0xa, '\x00', [@calipso={0x7, 0x28, {0x1, 0x8, 0x6, 0x8, [0x8, 0x100, 0xd2, 0xb]}}, @pad1, @hao={0xc9, 0x10, @local}, @hao={0xc9, 0x10, @local}]}}}, @hopopts={{0x48, 0x29, 0x36, {0x11, 0x6, '\x00', [@pad1, @pad1, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x10, {0x2, 0x2, 0x5, 0x7, [0xd03]}}, @enc_lim={0x4, 0x1, 0xc}, @jumbo={0xc2, 0x4, 0xa}, @jumbo={0xc2, 0x4, 0x170}, @pad1]}}}, @dstopts_2292={{0x130, 0x29, 0x4, {0x87, 0x22, '\x00', [@ra={0x5, 0x2, 0x5}, @generic={0x8d, 0x59, "879739479cd2948e61d9147fd84180928a0cf36e5ba2d1954af8a2735b1a09f7ee5fa0930fd789cea1f05407f32f44227cd804110b437d70c9b6a74bc7ef9bbe9cf5cd49247d9df5dd1fa079ccdc68d5f8e3deee467ace7957"}, @generic={0xc8, 0xb0, "c1c63f2085cb7ca169d97bdb512ab3e3659c45378579b337dfb8f15e39c5c5b25f5ce409e2a867cc4de4f301c4dcab82e2875366ab82f7c97c9d446c344bf8de7fbf243045d654af611d3e7dec2a8decbcd4d346c6c1c1c2025d1184299ca1a201876db98faa59a210b9b4158bce06ac54408175d97674fdf327628373c5ba378412088f3eaa1870b0e037ebe4185e0401f1bb4506e346894ff7d63996e91a69ce6960da1bfd3dce82bda4fb5a138bed"}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x6ef486f2}}, @rthdr_2292={{0x68, 0x29, 0x39, {0x2c, 0xa, 0x1, 0x8, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev={0xfe, 0x80, '\x00', 0x42}, @loopback, @local, @private1]}}}, @hoplimit_2292={{0x14}}, @dontfrag={{0x14, 0x29, 0x3e, 0xe}}], 0x298}}], 0x5, 0x800) executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) executing program 1: openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x1980, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_setup(0x2ed8, &(0x7f0000000280)={0x0, 0x6842, 0x800, 0x2, 0x12}) syz_io_uring_setup(0x6bd, &(0x7f0000002040)={0x0, 0x0, 0x10100}, 0x0, 0x0) io_uring_enter(r1, 0x47f9, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88880, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x1, 0xbb, &(0x7f0000000180)=""/187, 0x41000, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x267e}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x6, 0x4, 0x9, '\x00', 0x1}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000240)={0x28, 0x3, r3, 0x0, &(0x7f0000000380)="f3", 0x1, 0xfffffffffffffc01}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x3, r1, 0x0, &(0x7f00000001c0)="cd", 0x1, 0x3}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x5, r1, 0x0, &(0x7f0000000300)='O', 0x1, 0xff}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000002c0)={0x28, 0x4, r1, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x13}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000180)={0x18, r1, 0xc2, 0xffffffff}) executing program 1: socket$packet(0x11, 0xa, 0x300) r0 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x0, 0x1}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0}) io_uring_enter(r0, 0x7a98, 0xf7b0, 0x61, 0x0, 0x0) executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {}, {0x0, 0x0, 0xffffffffffffffff}, 0xf, 0x0, 0x1}, {{@in6=@private0, 0x0, 0x3c}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x200}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000140000e5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x2000000000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETSNDBUF(r4, 0x400454d4, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x183081, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000002c0)={'syzkaller0\x00', @link_local}) executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'bridge0\x00', &(0x7f0000000640)=@ethtool_per_queue_op={0x4b, 0x1d, [0x1, 0xffffffff, 0x8, 0x5, 0x80, 0x1, 0x3, 0x60000000, 0xfffffffc, 0x4fa, 0x2, 0x1, 0xfffffffd, 0x9, 0x1, 0x1, 0x0, 0x4, 0x9, 0x0, 0x7, 0x7, 0x1e2d, 0x3, 0xfffffffb, 0x2, 0x4, 0x800000, 0xf4b, 0xf9, 0xf2, 0x200, 0x6, 0x664, 0x8, 0x6, 0x5, 0xfff, 0x6, 0x3, 0x6, 0xa22, 0xfb2, 0x5, 0x4, 0x40, 0x100, 0xdf, 0xabe, 0x1000, 0x7, 0x2, 0xd313, 0x5, 0x7, 0xfffffe2f, 0x7, 0xc, 0xf, 0x9, 0x8, 0x80000000, 0x2, 0xf, 0x6, 0xfffffff8, 0xee, 0x6, 0x5, 0x1, 0x7f, 0xfffffff8, 0x9, 0xfff, 0x30c6, 0x3e8, 0x9, 0xe, 0x6, 0x9e56, 0x4, 0xfffffff0, 0x4b, 0x4460, 0x7ff, 0x10, 0xe3b7, 0xd0, 0xe7, 0x9, 0x8, 0xffffa016, 0xe, 0xf, 0x8001, 0xf2, 0x2, 0x80000001, 0x1, 0x1, 0x38a, 0x1001, 0xe, 0x2, 0xff, 0x1, 0x3, 0x4, 0x200, 0x3, 0x9, 0x7, 0x2, 0x4, 0x21b50516, 0x4, 0x1, 0xe, 0x7, 0x81, 0x0, 0x0, 0xdab, 0x7, 0x8e0, 0x7, 0xf615, 0x9]}}) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x17) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x7f, 0x3, 0xfd, 0x0, 0x1, 0x7e, 0xcb, 0x10, 0x8, 0x5, 0xb, 0x8, 0x0, 0x10003, 0x9, 0xff, 0x4, 0x2, 0x12, '\x00', 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fddbdf2507"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) executing program 2: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x3c}}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000200)="d150d6ade8f4542ce9f7a9cdc1cc7282bd4941986fcf4f09080b00624c87d10952711fcbfa6e0f8a05450f0572d81b600fdd9185fb6fbd4d240aa4bb15ed35b4fc5b83004ab3c65d05e784d8f00cc0c8c01c67fa5af852ac06fee4c8c6fc73637d2c0bcf432f23c902", 0x69, 0x2000820, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x1fffff, 0x1, 0x11, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0xe) r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x2) r1 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r1, 0x2) flock(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000500)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) executing program 4: socket$kcm(0x11, 0xa, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x46ae}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x58) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') rename(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='./bus/file0\x00') executing program 3: socket$nl_xfrm(0x10, 0x3, 0x6) openat$dlm_monitor(0xffffff9c, &(0x7f00000000c0), 0x1, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$kcm(0x29, 0x2, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) syz_open_dev$vim2m(&(0x7f0000000100), 0x7, 0x2) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback, 0x7}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000780)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x2, @loopback, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000380)="06", 0x1}], 0x1}}], 0x1, 0x3404c8d4) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES16=r0, @ANYRES16=r1], 0x1000f) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000008600850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000008c0)={0x84, @multicast1, 0x4e22, 0x1, 'ovf\x00', 0x0, 0x10000, 0x100004}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x483, &(0x7f0000001280)={0x20000000000084, @remote, 0x0, 0x200000001, 'sh\x00', 0x0, 0x821}, 0x2c) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) fcntl$setlease(r0, 0x400, 0x3) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c0001800800014000000003240001800800014000000007"], 0x140}}, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000040)={0xc}) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_emit_ethernet(0x42, &(0x7f0000000280)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x34, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x4, 0x6071, 0x0, 0xe7, {[@generic={0x8, 0x8, "09df168a0000"}, @sack_perm={0x4, 0x2}]}}}}}}}, 0x0) executing program 2: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x8c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}}]}}]}, 0x8c}}, 0x0) executing program 3: ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000300)={'gretap0\x00', 0x0, 0x7800, 0x10, 0x4, 0x10, {{0xc, 0x4, 0x1, 0x4, 0x30, 0x67, 0x0, 0xa7, 0x4, 0x0, @multicast1, @remote, {[@generic={0x86, 0x10, "47842058676f28b61b0cfa8ca829"}, @rr={0x7, 0x7, 0x6d, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @rr={0x7, 0x3, 0x58}]}}}}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xa4}, 0x1, 0x0, 0x0, 0x24000154}, 0x20000050) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01080000000000000000010000090900010073797a3100000000d0000000030a030000000000000000000100000a0900010073797a31000000000900030073797a3000000000a40003006272696467657fc5f71cbc"], 0x118}, 0x1, 0x0, 0x0, 0x24000144}, 0x20000050) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400c000}, 0x20008800) executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpgrp(0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0xf) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaa4e1daaaa86dd606410a600080000fe800000000000000000000000000000ff0200000000000000000000000000010000f5"], 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000640)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x2, 0x0, {}, [@NHA_OIF={0x8, 0x5, r2}]}, 0x20}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x1, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f0000000440)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2004485c) sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='k', 0xffffffe2}, {&(0x7f0000000140)="ce15fc9dc237ed5b37773a15b2f2615b0230a382c5bd51f04ff7e6c1f67c42c528244c3436e3d42cd667901a878ce7a4ebb5c55bd9c6f14079c1afebfbd8107a4a469b59ae1543bdc3085d6a10876755db8093b364"}, {&(0x7f0000000040)="fe07e4ad9a397dadc913c79649675cd17df8bf86309a"}, {&(0x7f00000001c0)}], 0x1, &(0x7f0000000080)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0xa}, 0x4000081) executing program 3: creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_uid={'access', 0x3d, r3}}], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) executing program 3: bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program crashed: WARNING in __vmap_pages_range_noflush single: successfully extracted reproducer found reproducer with 2 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup detailed listing: executing program 0: syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, 0x0, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, 0x0, &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, 0x0, 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={0x0}, 0x1) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING program crashed: WARNING in __vmap_pages_range_noflush testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program crashed: WARNING in __vmap_pages_range_noflush validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program crashed: WARNING in __vmap_pages_range_noflush validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING detailed listing: executing program 0: r0 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x22, &(0x7f0000000200)={&(0x7f0000001000)={[{0x0, 0x80000, 0x1}]}, 0x1}, 0x1) program crashed: WARNING in __vmap_pages_range_noflush validation run: crashed=true reproducing took 46m6.481660447s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pte_range mm/vmalloc.c:542 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pmd_range mm/vmalloc.c:569 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pud_range mm/vmalloc.c:587 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_p4d_range mm/vmalloc.c:605 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_small_pages_range_noflush mm/vmalloc.c:627 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 __vmap_pages_range_noflush+0xd4e/0xe10 mm/vmalloc.c:656 Modules linked in: CPU: 0 UID: 0 PID: 6058 Comm: syz.0.17 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:vmap_pages_pte_range mm/vmalloc.c:542 [inline] RIP: 0010:vmap_pages_pmd_range mm/vmalloc.c:569 [inline] RIP: 0010:vmap_pages_pud_range mm/vmalloc.c:587 [inline] RIP: 0010:vmap_pages_p4d_range mm/vmalloc.c:605 [inline] RIP: 0010:vmap_small_pages_range_noflush mm/vmalloc.c:627 [inline] RIP: 0010:__vmap_pages_range_noflush+0xd4e/0xe10 mm/vmalloc.c:656 Code: b0 ff eb 2f e8 93 f0 b0 ff 45 31 e4 eb 25 e8 89 f0 b0 ff 90 0f 0b 90 eb 14 e8 7e f0 b0 ff 90 0f 0b 90 eb 09 e8 73 f0 b0 ff 90 <0f> 0b 90 41 bc f4 ff ff ff 44 89 e0 48 81 c4 e0 00 00 00 5b 41 5c RSP: 0018:ffffc9000386f8d8 EFLAGS: 00010293 RAX: ffffffff820f354d RBX: ffff88803691ba38 RCX: ffff888027669e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffea0003000000 R08: 0000000000000000 R09: ffffffff820f3745 R10: dffffc0000000000 R11: fffffbfff1c48c9f R12: ffffc90070b48000 R13: 1ffff11006d23747 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000555581cc8500(0000) GS:ffff888125c57000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560f28717950 CR3: 0000000076414000 CR4: 00000000003526f0 Call Trace: vmap_pages_range_noflush mm/vmalloc.c:681 [inline] vmap_pages_range mm/vmalloc.c:701 [inline] vmap+0x1ca/0x310 mm/vmalloc.c:3515 io_region_init_ptr+0x24d/0x350 io_uring/memmap.c:125 io_create_region+0x3a4/0x480 io_uring/memmap.c:228 io_create_region_mmap_safe+0xc0/0x160 io_uring/memmap.c:245 io_register_mem_region+0x27a/0x3c0 io_uring/register.c:616 __io_uring_register io_uring/register.c:836 [inline] __do_sys_io_uring_register io_uring/register.c:929 [inline] __se_sys_io_uring_register+0x3b1/0x11b0 io_uring/register.c:906 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f627858ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc72f9b5e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab RAX: ffffffffffffffda RBX: 00007f62787b5fa0 RCX: 00007f627858ebe9 RDX: 0000200000000200 RSI: 0000000000000022 RDI: 0000000000000003 RBP: 00007f6278611e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f62787b5fa0 R14: 00007f62787b5fa0 R15: 0000000000000004 final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pte_range mm/vmalloc.c:542 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pmd_range mm/vmalloc.c:569 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_pud_range mm/vmalloc.c:587 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_pages_p4d_range mm/vmalloc.c:605 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 vmap_small_pages_range_noflush mm/vmalloc.c:627 [inline] WARNING: CPU: 0 PID: 6058 at mm/vmalloc.c:542 __vmap_pages_range_noflush+0xd4e/0xe10 mm/vmalloc.c:656 Modules linked in: CPU: 0 UID: 0 PID: 6058 Comm: syz.0.17 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:vmap_pages_pte_range mm/vmalloc.c:542 [inline] RIP: 0010:vmap_pages_pmd_range mm/vmalloc.c:569 [inline] RIP: 0010:vmap_pages_pud_range mm/vmalloc.c:587 [inline] RIP: 0010:vmap_pages_p4d_range mm/vmalloc.c:605 [inline] RIP: 0010:vmap_small_pages_range_noflush mm/vmalloc.c:627 [inline] RIP: 0010:__vmap_pages_range_noflush+0xd4e/0xe10 mm/vmalloc.c:656 Code: b0 ff eb 2f e8 93 f0 b0 ff 45 31 e4 eb 25 e8 89 f0 b0 ff 90 0f 0b 90 eb 14 e8 7e f0 b0 ff 90 0f 0b 90 eb 09 e8 73 f0 b0 ff 90 <0f> 0b 90 41 bc f4 ff ff ff 44 89 e0 48 81 c4 e0 00 00 00 5b 41 5c RSP: 0018:ffffc9000386f8d8 EFLAGS: 00010293 RAX: ffffffff820f354d RBX: ffff88803691ba38 RCX: ffff888027669e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffea0003000000 R08: 0000000000000000 R09: ffffffff820f3745 R10: dffffc0000000000 R11: fffffbfff1c48c9f R12: ffffc90070b48000 R13: 1ffff11006d23747 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000555581cc8500(0000) GS:ffff888125c57000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560f28717950 CR3: 0000000076414000 CR4: 00000000003526f0 Call Trace: vmap_pages_range_noflush mm/vmalloc.c:681 [inline] vmap_pages_range mm/vmalloc.c:701 [inline] vmap+0x1ca/0x310 mm/vmalloc.c:3515 io_region_init_ptr+0x24d/0x350 io_uring/memmap.c:125 io_create_region+0x3a4/0x480 io_uring/memmap.c:228 io_create_region_mmap_safe+0xc0/0x160 io_uring/memmap.c:245 io_register_mem_region+0x27a/0x3c0 io_uring/register.c:616 __io_uring_register io_uring/register.c:836 [inline] __do_sys_io_uring_register io_uring/register.c:929 [inline] __se_sys_io_uring_register+0x3b1/0x11b0 io_uring/register.c:906 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f627858ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc72f9b5e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab RAX: ffffffffffffffda RBX: 00007f62787b5fa0 RCX: 00007f627858ebe9 RDX: 0000200000000200 RSI: 0000000000000022 RDI: 0000000000000003 RBP: 00007f6278611e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f62787b5fa0 R14: 00007f62787b5fa0 R15: 0000000000000004