Extracting prog: 1h21m44.377694234s Minimizing prog: 34m14.808810268s Simplifying prog options: 0s Extracting C: 23.780688513s Simplifying C: 12m45.15975812s extracting reproducer from 28 programs testing a last program of every proc single: executing 8 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-mknodat-write$P9_RVERSION-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENTPLUS-write$FUSE_GETXATTR-syz_usb_connect-write$FUSE_INIT-mount$9p_fd-openat$tun-openat-mmap-write$FUSE_INIT-prlimit64-mmap-syz_clone-ptrace-ptrace$getregset detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ashmem-openat$ashmem-ioctl$ASHMEM_SET_SIZE-lseek-openat$rnullb-mmap-mprotect-syz_init_net_socket$nfc_llcp-socket$inet6_tcp-setsockopt$sock_timeval-setsockopt$sock_timeval-setsockopt$inet6_tcp_int-setsockopt$inet6_tcp_int-setsockopt$inet6_tcp_int-sendmsg$IPSET_CMD_ADD-socket-socket-connect$inet-sendmmsg$inet-socket$netlink-writev-writev-connect$inet6-connect$inet6-sendmmsg$inet6-sendmmsg$inet6-mmap-socket$xdp-setsockopt$XDP_TX_RING-setsockopt$XDP_TX_RING-mkdirat-link-getpgrp-gettid-rt_tgsigqueueinfo-ioctl$BTRFS_IOC_DEFRAG_RANGE-ioctl$BTRFS_IOC_DEFRAG_RANGE-openat$uinput-openat$uinput-ioctl$UI_BEGIN_FF_ERASE detailed listing: executing program 0: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-mknodat-write$P9_RVERSION-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENTPLUS-write$FUSE_GETXATTR-syz_usb_connect-write$FUSE_INIT-mount$9p_fd-openat$tun-openat-mmap-write$FUSE_INIT-prlimit64-mmap-syz_clone-ptrace-ptrace$getregset detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ashmem-openat$ashmem-ioctl$ASHMEM_SET_SIZE-lseek-openat$rnullb-mmap-mprotect-syz_init_net_socket$nfc_llcp-socket$inet6_tcp-setsockopt$sock_timeval-setsockopt$sock_timeval-setsockopt$inet6_tcp_int-setsockopt$inet6_tcp_int-setsockopt$inet6_tcp_int-sendmsg$IPSET_CMD_ADD-socket-socket-connect$inet-sendmmsg$inet-socket$netlink-writev-writev-connect$inet6-connect$inet6-sendmmsg$inet6-sendmmsg$inet6-mmap-socket$xdp-setsockopt$XDP_TX_RING-setsockopt$XDP_TX_RING-mkdirat-link-getpgrp-gettid-rt_tgsigqueueinfo-ioctl$BTRFS_IOC_DEFRAG_RANGE-ioctl$BTRFS_IOC_DEFRAG_RANGE-openat$uinput-openat$uinput-ioctl$UI_BEGIN_FF_ERASE detailed listing: executing program 0: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID-ioctl$KVM_SET_MSRS-openat$binderfs-syz_init_net_socket$bt_sco-setsockopt$sock_linger-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-close_range detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-socket$unix-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-ioctl$KVM_SET_REGS-ioctl$KVM_SET_VCPU_EVENTS-ioctl$KVM_RUN-memfd_secret-socket$inet_icmp-close_range-syz_init_net_socket$bt_hci-ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE-ioprio_set$uid-openat$rnullb-prlimit64-splice-socket$inet6-open-socket-sendmsg$nl_generic-ioctl$FS_IOC_FSSETXATTR-syz_io_uring_setup-prlimit64-sched_setscheduler-link-sendfile detailed listing: executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID-ioctl$KVM_SET_MSRS-openat$binderfs-syz_init_net_socket$bt_sco-setsockopt$sock_linger-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-close_range detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-socket$unix-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-ioctl$KVM_SET_REGS-ioctl$KVM_SET_VCPU_EVENTS-ioctl$KVM_RUN-memfd_secret-socket$inet_icmp-close_range-syz_init_net_socket$bt_hci-ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE-ioprio_set$uid-openat$rnullb-prlimit64-splice-socket$inet6-open-socket-sendmsg$nl_generic-ioctl$FS_IOC_FSSETXATTR-syz_io_uring_setup-prlimit64-sched_setscheduler-link-sendfile detailed listing: executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) program did not crash single: failed to extract reproducer bisect: bisecting 28 programs with base timeout 6m0s testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 23, 27, 17, 5, 17, 7, 30, 11, 5, 30, 10, 30, 10, 6, 30, 5, 20, 30, 11, 22, 29, 25, 40, 19, 21, 40, 21] detailed listing: executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1025, 0x13) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz1\x00'}) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000100)=0x3) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000540b4550182195f57584b3"], 0x0}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000440)=ANY=[@ANYBLOB="40bc9f0000000000185ce92a694f4dbe4eef7c8ff132a37454fba46f87ab9c3404c12ddd258d4681feb3cef669f2a24dfe5de923b7cd9e86a4eebe6e8fbce7a821"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r4, 0x400c4807, &(0x7f0000000040)={0x3, 0x100, 0x7}) syz_clone(0x2001100, &(0x7f0000000280), 0x0, &(0x7f0000000300), 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) socket$inet6(0xa, 0x3, 0x84) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x13, 0xcb23c9c9931e9af1, 0x0, 0x0, {{@in6=@local, @in=@initdev={0xac, 0x1e, 0x4, 0x0}, 0x4e22, 0xfffc, 0x0, 0x0, 0xa, 0x0, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x7ff, 0x1, 0x0, 0x4, 0x1, 0x0, 0x1}, {0x0, 0x5, 0x3}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4004008}, 0x20004004) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) fsopen(&(0x7f0000000280)='configfs\x00', 0x1) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f"]) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$inet_udp(0x2, 0x2, 0x0) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0xd, 0xfffffffffffffffd, 0x0, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x4000000000000003, 0x9, 0x0, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$UHID_INPUT(r0, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)=ANY=[@ANYBLOB=' \x00\x00\x00_\x00]'], 0x20}], 0x1}, 0x40) ppoll(0x0, 0x0, &(0x7f0000000140)={0x0, 0x3938700}, 0x0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f0000000100)=[@clear_death={0x400c630f, 0x3}], 0x0, 0x0, 0x0}) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x36) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x23ca, @ipv4={'\x00', '\xff\xff', @local}, 0x8c}, 0x1c) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0xffffffff}}, 0x50) syz_fuse_handle_req(r2, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000001840), r5) sendmsg$NFC_CMD_GET_TARGET(r6, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001880)={0x14, r7, 0xf66bd6b7b74c2ffd, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48004) r8 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r8, 0x29, 0xcb, 0x0, 0x0) sendmsg$NFC_CMD_GET_TARGET(r4, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r7, 0x800, 0x70bd25, 0x25dfdbfb, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1c8b4}, 0xc080) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) rt_tgsigqueueinfo(r9, r9, 0x8, &(0x7f0000000140)={0x24, 0x5, 0xfffffff9}) tkill(r9, 0xa) ptrace$peeksig(0x4209, r9, &(0x7f0000000600)={0x1, 0x0, 0x2}, &(0x7f00000002c0)=[{}, {}]) syz_fuse_handle_req(r2, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ecc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f000468e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb1000008747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a2ba86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb80035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e52af0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22383e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485a4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6bb06500f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0faad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784776f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2245eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a52c9ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bd9840e7597c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05412d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e4c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a768cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5effff7fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1bd8d9e67c43c5d70e72519f5f90d0500e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8656b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad64c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc590800", 0x2000, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x400, 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async, rerun: 32) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (rerun: 32) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') (async) setxattr$incfs_metadata(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x1) (async) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, &(0x7f0000000080)=0x5, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xc, 0x0, &(0x7f0000000000)=[@request_death={0x400c630e, 0x3}], 0xdf, 0x0, &(0x7f0000000100)="de54b9235c15af0d7e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba96607f43f8d780b0f42478a7b03002fc21aff55002ce55e850264e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70fc61b732623091cbbba6f20968671bef37f329e53bf5e3aed848fe37dc543eef4820005577af7e9546d62f380ed468b86b00d62a6dd4c7667b0a71f1246480f2627e52d799a1ad6285f9"}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x44, 0x30, 0x1, 0x70bd29, 0x25dfdbfb, {}, [{0x30, 0x1, [@m_ipt={0x2c, 0x1, 0x0, 0x0, {{0x59}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events.local\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async, rerun: 64) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}}) (rerun: 64) executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x42e01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) modify_ldt$write(0x1, &(0x7f0000000900)={0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) (async) connect$802154_dgram(r1, &(0x7f0000000180)={0x27, @long={0x3, 0x2, {0xaaaaaaaaaaaa0102}}}, 0x14) executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) socket(0x18, 0x6, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) dup3(r1, r0, 0x0) (async) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_handle={0x77682a85, 0x100}, @fd={0x66642a85, 0x0, r1}, @flat=@binder={0x73622a85, 0x1001}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) open_tree(r2, &(0x7f0000000100)='./file0\x00', 0x88801) executing program 0: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff}, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[], [], 0x6b}}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000040)={0x2}) executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x143202, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x419, 0x600, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00220600000083f8e482fbb0560638508c827bea7e0a000000d08a6e3fc19f98124e52a20de6a09accdd2488239116aa062268edcdc1d991102a5cbe16af361f678ec41b010000000000000000ab0bb3a9935b623f1cb941a0bf8752d103171ec44bc08369806b51e7f59c93369700fa11833a101cf3d37c6da024e4d22f5f839b179d5995e247536f711e9b20f3e1bd3649ffffffffffffb5b7737f1bfbc777ef25aee240e22329a8c71d241998f2174c921cbc11d48b49390f79bf0ae939fca77c2db67651e6214bdd94fa3caaf3d19e1762940d946632d842c0562edbca324ada5497a27eaa656e058562eb88e2b2ad8aec7bfc0217c6449f7af8b16e447c7167f3e990d65d62a0ad66076bbe0ceab9e803feb77d56e653de445c36d8e21710f75d5800722b362da9f422cc997767484d056cccaa1f5ba521111df74cb987c4c662"], 0x0}, 0x0) mmap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x13, r2, 0x4758f000) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000001100)=@req3={0x8000, 0x200, 0x80, 0x20000}, 0x1c) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) mlock(&(0x7f0000081000/0x2000)=nil, 0x2000) sched_setscheduler(0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$cgroup_int(r4, &(0x7f0000000040)=0x1c8, 0x12) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r1, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffed3) mkdir(&(0x7f0000000000)='./file0\x00', 0x18a) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r8, 0x0, 0xee01) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000240)=@known='system.posix_acl_access\x00') executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002b80)=[{{&(0x7f0000000200)=@in6={0xa, 0x4e20, 0x7fffffff, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}, 0x80, 0x0, 0x0, &(0x7f0000002580)=ANY=[@ANYRES16], 0x100}}], 0x1, 0x4008800) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) getsockname$inet6(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x40) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x40, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@default_permissions}]}) syz_clone3(&(0x7f0000000b40)={0x2000000, &(0x7f0000000880)=0xffffffffffffffff, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x8) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020}, 0xe4bfe319cd039830) executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) fallocate(r1, 0x50, 0x401, 0x10000) close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 32: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) poll(&(0x7f0000000140)=[{r0, 0x240}], 0x1, 0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x561}]}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000b10000400008000007"]) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r10 = openat(r9, &(0x7f00000001c0)='./file0\x00', 0x228082, 0x1) fcntl$lock(r10, 0x24, &(0x7f0000000200)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x928) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0, @ANYBLOB="01022abd7000fedbdf250f00000021000e006804020004007e15000403ffffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYBLOB="7a391670fc4a4e84132acb9e190403e146c841316fc4631c9aa062f25ca49bcb4ab6cfbb54a77af51bf33445a9f136ad3a8a7d81e2ae25f90f6452d2ef5c74806c7d9e69c6d94563f481f4848855aa247db96d83cac651a8bd3b13c0"], 0x68}, 0x1, 0x0, 0x0, 0x200480d0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0014"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="67f20f1c842600000000ea82b7240166b9970800000f32360f01c9660f38815d000f01bb47def40fb4333e0f00d2ea3a6ae200", 0x33}], 0x1, 0x1f, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3f) ioctl$KVM_SET_MSRS(r15, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff020000000000000500000000000039"]) executing program 2: ioprio_set$pid(0x1, 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) syz_io_uring_setup(0x2c4e, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x20000003}, 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1243, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003180)=ANY=[@ANYBLOB="38010000100013"], 0x138}, 0x1, 0x0, 0x0, 0x24000804}, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000b80)=0x2, 0x4) sendto$inet(r1, &(0x7f0000000740)="17fd8757270b23b5f2d12809a7b93d036023c20509d8d2b6d053b8944677c9d2ead3a8885db1d0bb7ec41c2f7d0604a4ed85f38d68f1813bb86c018a3c7139394bfecfee022378ce51bdc51590e0d0478f1c9d6d7a791512beb6cf73dcb86832cbe9c8a69532c088e59fdad44cd4a8ee00ed352d14e2ca413fa6d5c2377825b22b01d64fd9897acd4d7010ffff0000000000000ade8e2debdefc6dbd83a9c32eaa02d8c19fd73340054ef04a9799e1e4a3e1eb462a5f3f40312a7586fea68bf35d000e6bb666307ed85c77d20a2afc5a8d50a8db7e19825e7d54358e9377ea30027ab7c80746049c4aa2da53fac7e9940188b47402f4", 0x59a, 0x140080c0, 0x0, 0x20) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x100080, &(0x7f0000000140)=ANY=[@ANYBLOB="205d64653d303c3030303030303030307070f24c6973652c00"]) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000380)={[{@mode={'mode', 0x3d, 0xffffffff}}]}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f00000029c0)={0x2020}, 0x2020) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000005000000014d564b00000000af"]) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000180)=0x1, 0x4) syz_open_dev$usbfs(&(0x7f0000000000), 0xebdf, 0x5e7b02) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) syz_open_dev$loop(&(0x7f0000000080), 0x5, 0x200100) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) (async) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000300)={0x1}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents(r3, &(0x7f0000000200)=""/251, 0xfb) bind$vsock_stream(r3, 0x0, 0x0) getdents(r3, 0x0, 0x0) (async) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r9, 0x300000b, 0x11, r7, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r9, 0x3000002, 0x10, r4, 0x0) (async) r10 = syz_open_procfs(0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, 0x0) (async) fcntl$lock(r4, 0x7, &(0x7f0000000480)={0x1, 0x0, 0x10b, 0xfffffffffffffa8b}) (async) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) (async) syz_usb_control_io$hid(r11, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000005000/0x1000)=nil, 0x1000}, 0x5}) (async) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x2000) (async) prctl$PR_SET_MM_MAP(0x49, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000/0xb000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) (async) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r4, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000080)={0x100000, 0x105000, 0x1}) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x0, 0x3, 0x1, {0x400000000001, 0x180, 0x20ff, 0x6, 0x5, 0x3, 0x9, 0x3, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x1}}, {0x0, 0x13}}}, 0xa0) pread64(r1, 0x0, 0xbd5695353d88c232, 0x2) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, &(0x7f0000000100)=0x6e) accept4$unix(r5, 0x0, &(0x7f00000002c0), 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), 0xffffffffffffffff) futex(0x0, 0x2, 0x1, 0x0, 0x0, 0x1) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000840)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100aebd7000ffdbdf2501000000f9ff01800c000180080001000800000004000180"], 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, 0x0) executing program 3: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 2: r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) timerfd_create(0x9, 0x80800) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/3\x00') syz_fuse_handle_req(r1, &(0x7f0000002240)="26b2a8dd3bb50b8ceb62f430e5885746b5fd58b5a47a2bf28b373c8660a05cf8181b4b7a61b8ce127e9a2c0e92dea9379d5ca6b58c15037915bb4319621bdbead01cade5fc0535760d2286578af05881b83e2c2007508ed17ff1e44b5f91fd57e1077aaaf77b6741f58c4e426bb9b1ac269ddb81ba7c1d6ee457f1bb8ceb4e8a69db85ebb1df95fec7f3b5bd95dd726c920792e9a54f1641d5578f4347df0d583f76f962383980e8c6a1c123a70212d089e9b35900b052f0ee59eed7cf1e133398f5f5bd78d5c9820ee007f32894a57377a97af57c6d6dd108231b10a94c67f18552a65b870b7a9afcdfb72b57b81b1e424f739df21dfeebfaca906901b2626cfa482aabcc62b510255ee5010b4c1b260471011275c7f242659df63a8de398c2b0dfa67422e519853a439752898451f9f02defd4ae71ecc8aadd28d21a339d35cb425e109a5452d01d1ca2fc9cd2572a1252582d4b179876cc489b1b3fe4767d0356c29e6e0b891991f1dd5acc3c3e35f9d0048ed0e28b9771295729aeb5a1e262ec2fcbb545c3e24799bc424924294928312b42be902842083b4d7383ed289b307b66c8568277b3c17fea747ee49b750d83dd7ea1f18a5eae198451bd2968f823e03a4656cbbb154145465ddc7bcdd0c7b1d07366c0a4090e4023fd98d0f77d3949d7788bf0b31c52c7704bbfd681c4691d16ef610708ad2ae5af88301c5b0451ae9f292f16aa44230e53874a432be156fc74c9690983928aff88c8d817c86913fdc8425cf2cc43297e89321dfbbba3f4f1b8bcb602a17f1f5918c0657a9e0230f2722f2aca5f2f931c8c91dca589c02a711db5b7ca36f3a49282c4ec3b447ddcbb2f94e257a384d8c17980a3962b2c7b5c0b661899fd1451ce783dfb29355650454b65479ef40a319e37e90757ec3e3e08a2bbe0b9bed99d8bb31e5d240ffa66d5162748f30635658f92d864dc6ee1d95d9b6e19e554f6a4a5cb4a067b3c7d7d882ed4f908337febfd5cf00a6fd68e95fe62f5c374399f6d3201d3482a0637ac4d9d8253fbbf6bfdc3feb9db0a3d8a85cb337dc7a1328973e20bb82bcc2ec03a637f4f29e1efcf4fec09568a42ece4ee0508a0da8206989d12e522a65e76c4d64bbaec9f328b927391f2b15c7e8b3f138ef345afcac4d566448f327f84ed41f69b4d40c8309d9d5ed6846f788198e151a48f654d29b659f923858d443e118409541cea176cda5c518a938d10086148efdecda55cd4990922cffc06633c59db0c21d12e4b311e3858e82001c24c2225844019f9d633679ee75a70521da58cb8809c193c0f3389dcf540884ff0b44f224cbe03623ee16ad37e00abd1bdda5972379bfb097aa2ffe5e881ff988644b1364d8117feb6859fa4a942260aa6ac51387bc4c9173b8656813929744af772742e69d78f5b127b3ec8a64a3781a603a56e05eb948a003e54f3095e56899dc6413c4317e12141b3409ee8d33dc77ff33b10c5294c5e6b969848dee370c19e732f3e75a6bf21ad433c99d3978f8a8254fcc589eb067e3663e6179cd7904e080048565f0d8aae47d0dec7830d5eb48cd386ea8ff0cebf7bf86eda674cabd0d06f2068817d1d85f39bff655bda536ca5d9727545b8202a982818c388ab0219021fdf4dcdc5de8731edb03e9170a8867b614e5317f76f44c33563fabb73eb4cf8a766b6299e52d00646262e6e7704748a35322cdd7c52e6bae2654295f7804f68e807d5ce420213a278b751b360bffbc1bb9a027b98e65e9dab8fd143e02c2e6192eb8f411d80aad0fa5ff40ced48d26e076cda037ffed74f19b1a35839239b5d14e57fcba05aad705435f998d5a85c05d944bfc472ecda2974332b9b44c448365682d00e271f0fd2a436057adfb7b8eca4abdb8c1329121d6dae395dd1506a95c0de8191bd69cd1f68ec5af9a88fbb1a37c082b9df5cb390379f2db48c63e9f779b875ef9891a84181900bec4d6f512e4633f6b43b6abcb87e2e72f74d8cb0ea3019860339fdcff45dfe7e0817de819eef61d6e91b05a6b8ce8b0e1416e0210813429ff7a75cbd6e7a8f5c1e41012f8b092c6f0b45896a3de1a278b80104157dec7e210aab22aebb54ec881291fee48bc1c413f6a0704e45c1b00f39d4618147e4e11f429592bc92044a772bb33349d3ee4b6c2c5a5a8fdd5ad65434943c3987be2ab99807e23db8b9ec30a3030be076b7871c1bc7a9d4506f3a1e7b986d2ea1b60f9240db71a360c919dc6dc24f6af5878efd95d83f5a9529266f2fef29af2b60d214b21b6e3b8e5b3555849453f66e3b2fe46c2547690b745cf6b850312d825c73049a9a009d66d0d58801f254e2dc32897d9f3bf6fc3fd9ca6fef5d0f0dc55e85a99d735d1800f418010986d80f04e7f5a37109b73432db749b569966e781e646c0e373c94d7797960e1b73cb6cf58ffed290c567d7b5dc54f7a9c911d19fab72aded28cb7c063c46fd530b6ea9efef61c4da2bd5bad7d317743314ab01046b0f92d9d428a13bf5ff427fe25bdce29637f916b2da55f2f5ff05ea17002bf139a5740b7f2b60d6048844cc3909c76eb9ea0735ebed9c201efb8228245373c97d8c565e1ddb4c4d07c1ee7e3a942eea3cb88b2b263a0e4eef9b5cbc99f0b1fde017d01b15820f55f51d325c77c298b6973ad694b1f3bd5440fe8e8ea72fb10b53bbfb84c7d2b7be416df5cb60ad3607c71b387687752a119afb71cdc53b8a395e0398a5be4ac9a175df444ea715fbb2703911bcc6867a85ae2d76d25af06ed0e3688660dad6d69c1f356d43e655811e4169ff9f3f275a8417c44a9b7f5cc3e6ae05ed6a226da85946e84144191b4018d2a226e957e583fb34af3d4bdfbb59da087565fdd7faca17d652208c129549f16541f8addf7be170c6041459600364f025362ea0726f48cf82521d47eb478c341da8b0ba94e96942787d4046d04e86b3ecdbf4b3579aa8f00ca70e132609df358d9183f6cf6b200dfd16fac3e0bcdb13cc5bfb20bde3cc139967c70fefe3c39f484c442b75a5606a2b4952c799b04957e151d3dd76eeac764170a1929a88a668926fd6c22e9c2327f85fe88d388f4eed175a5c13e82bd6f42a7669341d2f3012c75c9871e419e0f3c7e50e347856415b8584eb2d2a0214d5bb03b10a26505ea9ffc7d5aca844e24af916eebe7513d8dd9145049aa0dd8e2a5a9fc53cef6239f56f2ba429601ead8223b5d89e5326e09f9d7c409a466fe5781435b9c324efc040cface76eb40b2da68b71a8baf2f916303726256c772cf27806d5208724cdf9f4eef7c7f3084a25242479fbe759bde637a7cb96d98510f0a68876d04cb47a3e7614b0b51f8812727b0881da22bf270d4a44206a581e71a7150c4096dc1fbd9e724ac572adfa13d6c2129e51df101bd5fd45bc57c356d67b65f270168bd0601e0241e887becb130fcb72c398c6e50d5123f5e8cef49d7ae92ae8e7de2221677a8aa6a285824ef679c68f87330224ce2c11299878adf4f46ed510fa4286f6110dd9965c189c21e85654d44992593ad75bb264fa4c9c7f600224b8eee14e6bac1aa0f9c9bc8c10caee2826cc6d8a787a9b98f908d062732ac0226268047fb44fd950d8ae380620c1f594a68a0813b492bfa3a8560dc1458ba84ddbf9b58f0f7317589a36c66493d1b1093c50719fe4e7b3a7f9dc61e961b0a36b0d65bd14029ad5b9dacdb4edbf090c2455c6c1af080e5447ec7aad8d1a532a48ce280decb70918738b3dcd49d3ffe16e1a2099f7e083aec3a97866e51d43e2581530e53d269c4ff2a6f576ecadc018f4e233b6e7da57130bdd369bdf5973031b7280d7bfcfc443dfb578de9d60be87e741e3aabedffd7b46e6a1c342661b0a122d579623e6e86e745e6ec3ee53545e9a1f63c1db363f68ee2a693a8f8bcd5f97c575db2ce1e03fee213bbd7a38a288fb83a07b1adeb99932fa55dda4b7e6be199f8f008abaa88c63f59179b47c541d8707709c7cd5f5aa5ed5c4dc63093596b09858952e64133cbe6b7d02b60528d6a263c9b72aa3e751a99e9fd1664121fc0ba9018d61011edd23d29d05c2080e33c721e503113be23973351a68fb5da582205a0e89e69fc84e24f3d4e8629847f9b6ba77e2ffe6ce394f99b1a94576c677e7433aa8bdc4d9779cbb706c6e2f426806d111173ffb0cd4f7be3ccffcfc9e66a16ab2806b6118ce28bc935624f1cbef0c9c4da396e6dc0e87ff20d0fd0e07d49327d8c0c97c7d70c50b584fbe563cde1cb17f36a73ebbe6b331b6321ac5ceba510a35ee913c5542a9d7b12805a29a99d25a5d3bc13a330435d6f0305bf522cc71e261c39d82584440d47fd82b9b31ad4ea0d2922558e6bab6fb6d3f6da9eb2a2e824af6928ee2ce41baee61fd4b5f896bf92bb1cf06c0c5a1b9b81a8216084c8e90451823d6be884a735a2be130304a22d8168c06db9cb6d62ba30079ecc831952f2564b760153311226d2188bc523928aa63223e785e6cf67a01962eed4195d5b06f06f272fe27d38660153c1727cfb438b5d98da5778070791c5ace1fd3ae756c8f261ad9d1c6aec5722a8e0609c3bb672c628879b65fbba3692070781c13bd34a93a5b9fff4f9ac4cd6aa3fdf076eeb4c0cfa14d2a41193e723d6d013995f34c97bd5d438eae8ca9a8a2dfdadec39c84c11cc9e9506020e072908178a6b60c53321c0b857d12b9adb58d90197c090e558d20a29bfd9f2ae297c23f47a544daa537f5780ec75b1824be5c92c20785499143252dd2f6d1f8aaf47deccbabf74ee0d55793b046aee7dc763353249f03cf2f0c60f6dd6ff082a051ffe2c8ef4ae9b1d8a046af67ffab68a4587ccd0a503906cca13aac0b7309d5fed12abd5303d2803f928651b51dd8747db79c56c3e3f89e6799a9dac3a7c57257c6575e133379b6c616dbab839b530e7ede62dc529acf5a6fa061fd1244fbc82d6e883388291ecaf1130151c8da538f8bccb9b871d2ce3417a9212ad94fe94c6e13e06975d8ba285d7e937ac4c6fd89aae06db06940670463d6b86a18856cc978a49f7e407f2e4f042d7ee1b7791cb33697824c68b2535af6c803e7940512da7db39c98ed1030e615569c200bc3ab833156187c25c1f659dcde3434f47a8cce56d821617c58907f80d5628214a0a8aad3fa2087647d52ac1c9692c6b57b85d70cd12875f110e631f3a9e34f21afc401797d9a13753deabb43fef92d691efb19a7120167f838d283fc5f2f1d7b4c2ef736fb1c8a47befcfd320f98461756d6908f00cea4a252733db78b6f67620e1a209e39f788a8360b8f42ccf1776259c6f70ef7ca2b0ee8caf4bf27017730236669eab62ada6db1d381ec2f8c60bebf555425bab9fa4d46823d3b0a1b1f51add64961aa2a073929116f02ea230bfb354019e47800415edeacf72a7daf8930c64adff306aba841fbe75bb18da73441721c86d3a70f9e6025e7fc95516703372fcae04421b08d0edbc5f1b6b6a3c66225011dc19f575111180e8d173922c2e28123347036b3ff2418dd529c49beb2e335801a3a5473c73d71d084c8271c10d86f283a659deaa57fff6673519645e0ee4c915cc3b8c440584fe222b1bc0cc0888142b9753ad409ed41ca16a92a3126ee73f7237523c6c781959fd255c5c0dff4ff324dc3e2246da77281809ead68df57e4ae6c1f8001e6d292e8e42f897b59770ec26b508ac5d57b47ee9696f9d40ceb39f9653a14737ede3f3213147381417d9633d30cc1107dde46e5ead6e4e4dec617202e10b9093e3bb2dfd785dd96a6a64f44bef7465552dc2e391c978c7ac1ce2b8f774d7b3934d15fc6d96eb3de6f0e9402a8538c6081712e5affa5b67b4153217b38f3248b2565c804226f4a31688d5fafacfe2e4fc191791c7164cfa33a474f4a9cd90fb5f37f5268e1801a2a762b00e8b7b2bda1db7a90ccc74ccc0fb015eb49a6ed0236d8b6b0e67bcaeeb750a499cfc3b2dc34e9024ea9bf00e5f0013a15509992979b50617dc14aeb0bac46c6961eca1e96ab2b45d342bc68e88b765a79d73f1eec58167e8ea4752981fd898f1ce528e9ba947723bd4d2ce228b6e5787227697d52f2bd0d4ecbebf5c6164f5819313060579ebb3ddb3c6423adb999975427c2d3da65b3cf52849c75464b46ede138be670742b175474222a47755f8006d4752b6c271643aa622f8439903abe53595792e7856a6e5a5e1b309fa139c2e64e927620c87aec8f36b9509c1d5cdee296bdde21d2cc54e7738070d93552d9ecd799325fe6fae9f3d7046ef1459d401922e3da284b7f6ef67ae196f274f6ce94887bb5ec25c0101618d6118b4cf47e0dfcb8dc89e8f44b47ba19c326db51a75a5b790620a2e460110dbc0f923a7d3825e4ac1d04597c0693fd05d93aabe907b47b1581f915de89c16580ae484f864e583b43ddc0991d716e401f60b6f62ebd52178a9e0adfbecc706dfffe8eee93f67ba2c9da4515bdfffd764741527ec04c3503da653271f2051ddad922ae38cae98c9a2eba5f8470d2551d2224add25a32b9c4d573f69ed15445d2b72ab20d1cd07c2d897dd7c97edab293db9f217a5eee5de9ad08da2f734e617b9f5268a3b91336237f5e9738a65f4adde4279eea09ce40e577b97eb5c67772e4ebee5a33afc7de28c70d97a514cdcd95908d26ad62800900a7cb9dcb88955b5401ccd4d965d00ebf0da48bf43cd2f5b61331894f523685b17beb253c3f50db89e11e664d6427a2551b5bfb2cbbfbf1e8240909d5eef23ccfa23d185391713d1205078be21e99063ff6316c06cd77969dda4d7f3350d4f2f29a23f12e14788fd60cbe4c3c00685a5e42b861597fd3b70c5e0e4d9f02355b754bf353fa2bd5dc0225080c26eb39be11a5b3cfe5264f39399167ab55ae7286f09c1d7fd0fc69bc9c7fca34867b5bf11c43612d3e010d2918a0d9b620549402f2c56e9cf3aa53b7614337f0867fe08170ffb272c5d340f237cdca3e023d2e65b250acf4f265ab8794a5388c5358d7e1cccbf82d99dd1aeba50f3363b9c3b6ac43542334bde8cf2ffd29da1d516bb5d950938f410829e2e37684916e1eac5c2ea1352e7cf6d0bc19bf16bf4ee61e44cd339fadcdf18126c46c0aba43c927510f3b876b32f606bfd2f657254e9715f8151099da8897c287ec1eb9077c72a0a31171f5e2672c16d3907caf659a73a15ec1bbdf240cf5796c22a99933999dd36ab3c354736b45b990e1631be048cad72829f782504ccff0cfc2e1eb5fb3e52e9fa4c3a39ec9ae7ef7b4b9e7e9a721a3f6addace5ca68d525ab9dc0d26b05333dd638bba4e40ec0a716b29172fc84a26c046dcdd0a744af3a7da0eb295a6b0d2a4e45bd6222464cae11bdb5a6c02f8ebb9c8846ca03175d4cab8b9c9531ae686029cc740c296feee12fda2cfb130808a3fd435c13bfca388ab530b8c4b546c4fc9af86596daec4569b5e82c8fd452731e27f9dffdc5713562b99fde6b59948a46f2a44ed0e539469040bb04a54fdf390f589c6491f1057b3d44573838dd2a1271ef8ccec3796012d2debeddb9dd0e252bf622f2671d6940f1c89b3ae38b4fcaa37103d96f4504c5654e603b80f710dc575bfdf2f4fa01741ab79057c15b627cd03e7dc24aab3ee312dd1d7e96731c28e24df9b051fa5972615858f07572d07f6a6f947fecf8acb05d220b68a4962b0bb9e2bb6341b97b0bfb18dc92764ceca8f723592c02104a020dfb9ff06bebc81ea80c68a1fa6175ab4042abd3305c1a17b72ba5491dc812def91672873fdd98632871ed0387e00a80c173b9e8c75e185149d32a9945e2f9707301c96337cd1c44cc13a9f38dc23720558c31c4cf6ff72559794c04af4deccbeddb04f267308e220963bf64d0aa830af54a91ae3ae0eb1aa3d48dde97ddd0916e3c16f4d90ef3e66f06f8c4c3d4fcfe41094708f49ac8d4e7150a74d9378a75018dba062fd1ec331776aafdb64e5e1732ab0f0ce0bd8985ec4b1374a6245b6d714a1c02ababcdc1fe22481a6ad3276662d4c9adf65e9d275afa6d57d6c3bcc6ab68234f4a1dade56c852c86c0bb4f427387bc9ea23e7361b7f518039af614141a12499b9602f95e2a969c7f31cf1056fe3b1954ecaa3db219f546a28e954964268be0296ea2765a8194d88b14869d388996d645f34511d63a602d92e795a0b29773052ce44b008556b6a0fb418a9233ed13edf3bda3db479211d00c16d40ee6321241d884fffeb3c1e2c01707c7aa387778779a241699ef4bd5d7cb8e40986539d0778cc242e98f17e630a09d62155b469ef5dba920d2ef80686c8f9eaf1965b42935d6dc470de7fbe0f5083a4b6ced2fa06b255fc35c3325bcc57ae3ef95ef58edb0b45bbff699de88afa565ab9f98b1c98255dfd6bd3eb18af00b94cbe5f94421b2828b0583c91e7cecd4754003ad8f46a206da99e75056705f9cccc481b591d4c33d96b21acbbdb4e70dfd9b6a2fccaa6a0af7f97fca9da759e62a6fb222341cbab0c808d320ff13a5989ce707aabd7f7c569b3e22e0c91613c483c136fb5b94ff7bdc1f51cbb9f5c46e4b62a19cca73057b78d1f3f8a9b0e2a20b8b8d9f2e8d0459df86c18353fbb3cb6e8b804e28dee571349e16b5df662cdedf1aa5a44eea00b778bc79c16138d85fab98c15ad9f2b83eebdb9432634280768397d2895c10012da8c6659e02295cfa52d6d06ef1e6ed0546d46c676048e5a455261659c83492d355eee56596e520962467fa8b3ae99cea9547d99a6d6b674682363c0dd5c8bd5c63d3bc2d45a94fb4e090ca27028b29a61c53d96ade29f1c60cffb5053b494dd2d7c7ccffc7006e16eb2bdcb360a1e0a3fa1f380616d0298e315808db7ae9ad16b6c4bb7dece5c2c4ba52d514f7fdc9b00e66302d1b6c6a7b5b58adb313e0cec67448238f66f69dd480d304a9831833a1b94f8109c0d2f85e646077bbaf140f9c7e72301d8e452f13711be18bdb48e2f0031c38da789a9e4161b7f0a6da09075414aaf9984ab7f141647c532e3b2530f3fd8a93b4218ecbbff44c4a58cdde1f9d89eb60ebe8033dc10116cbc09d4903bfd0830ef8b0d33572ce61bc028133be720544872e4a205fed6b005e8ed240ceb6e9efdd313b6eb0aed6bdcd335cb1765f2d7ed7f1819e0c04a8989183abcaa3677c35c33d95b139ed63f9f67e51386206ee2a3ad54bd4312b1178ece5a5a76eac9534faf2bb8c7b5105811a34a110553c63f1b9168ec5758e39d1f1baa4fd3e8dec73026c08ddf1568fa04b1a36a98055b6912f4faa0741e0bb5f063dfab6e6a8605b997affc69369980188967e4655c954d31b3ebea8dff5face904366191f0695fd3ccdc5e82c5982243e16a895f8aaf9d63d37ee1d323b296862ad265760a392378bc2ae5d7b75039b77aec33aa00c134f554ca9e5fd162296e915ccd359976e7ce4099bcaa5494c8eb6fa4da2a2e245920762f3639fa4fd4eb0e5e167a5f2111bfa669576ff3e0711a4ad78d2f8477363b03e6a13cd5b479817a62614ef613ac2b03a340114909c7b21ee93adf74c2ee2d4c666f1ab8bc43368e7643f3ea8da5a919b1e3078875228d2b519387ac49b7b9990d7dc229fb9ff0d551d3dfbeb843c8b2782f50cf8c575dec6836259a160a9a047165791d1e759c74ea65f4f9da990fc0e789bcd4ddf716442864788be6f2c5b607b6ddc7f9575b4e8375eea50e98cd9320fe736114e03aa0a2c1430d5cb507b29b388ace6ab58393513724607102a0458a458998e94d71b758df51ed4ecb6c6f2b94c31fb480745fbc6f6dc595c9558161fa14462779952982adb70d70a9f9a734fcbde17652e1a91422f93a6ff7d6c80fc92a5005bedf58aefe9bbba9d0ab3441e86b863bb5a3fdfd2a9c6f6d10717d2cd35d3c2a892f0e58545b1794d9aae993d72c215a6673bbe38976cc7d03cda84999c637aec8036ea1a23b143ed6288dcbc7d1ee487b1b6a4f6e8ef63b378acd4ff888bf95d86336907939c29695b2e0cc58efab49056f88a9027cad6d724e635f94f45f4cbddd8188608663ec7e46547e2aac7dec6cc5609e9f5f41ef26a1f16ecf6bfe200b0a955f98d9a4d41a2a268f8857670e33fbd4f076aa11c49cebd8306a4de3c86f7726fde93c7fc984079ae60e63854ee9a14162c749d7e308530c6b84cb5cafdd09ec3411cc0302c77d316beff973e3108ddb9b249e206d5476d605b7b24603ca344c2263bda8d7d3db55b9e2fcdce69be9b1ce24f8c4df129cd62a299fcbbff3309031973b5da452654c0b8ca4cf65891a8bdb8dedd20f631a34964e3bb0fa45c618861da79b259d79ecde8394061c99c661851c016c35ee8c91d52bbbc25f52b5e2f77ef2f63c764b717e8cce4d291742d5a7ef7f5d7ec1a96620eda1f962fb2448c388873f8b8abea4d27a5da092833c43c57c4b14099597f83785a31190798826f4264ba8f998cfbf7f20f9678e10e05c793f5781f8accca245d047d3be6c10541b2610c02c6e916d3db9776c6964e4519cf2e30708c954ef2492d3418c552dd9b5db4320dab8be6ac3394cb4b3fb1b9d5222c6ca9bd06aae2fef510e541db1209cde21fae56507020e80862d0b875d958346c42ebb781955ab337be61a68534281100247904b81b86aed49544c2452ecffaf6cc116f9d3c7362fc2cc390ab2ad29928b6e8bf90a4f21442fb213dbeeea4b8f481792fc6579b608e3a9c4fbe2755010d7ab3cd122de7a40a1f7780350a31d83ee5006ade36854cbc8e8c648259b29f2f7042719ab4d4d4d1f0c5fe6b717d23a5504335922f84ea8b20c78a5f1ddf6009089ea221353c01963fb8cabd3d795831c86d084660fa7f7d08f3ff15780c5b301ee27ab8d98fb358b90e92de4c96687c37e327ac1f0f23208c41a36e67cc22356df854f2dc309c110cfae51c5cc69051d22477caa1d2a2f276ccfbe907b263bd79ad4c5f6ea2687466f325ff2b1a736fff687c14d477c4c744e9c82be5b8ebfb69db2b312ff540ec8cadfcba9b609cae7e54ff347ed3d2649f9214600870ecba27f98943b4fb72f93b5ecb6d64dc1c7b2e8c2f2cf1006e39a237c5818014df9281feb6e522f6cb2d5ca35aeada09a58d5a6bdc9a75cf81a1c51faa8a3824a58d192a27be9fee5098b2e71d0d3f12917d50667415e418b790e0942260f4d2589c57aa1bd36017bd2bece963f0776f9f76cc66876c3f88f8bdbc35e329ecb56887948fd2c05d49c664509a682c6ff60350070bfd111be86ad2eee8c0d76b851fdb75f08e11fa47b5fd29b57568abbf91d3760652d475558bce2a1393688c9e2b4ae06cb072c294e1396b58db00b09ba8dbdc047a1684cca6e5b04cb52a40dd7b7f72c55292e7af0f3b8dda380d45b4e71c6cf57179247923750551ffd955f815cfbc29dfe5e0b2689eafdf44ce362b9c5864e4003326b2f183df7d39de7632bf3b2a85dca04cda08d10a5bad9ed9b481227e39804c3fd52d8a8f03288e13eb09c9075e23f82123a416e58864d95a321a719f88c8633201eb7d5c429348dfd83b476510f71808f95ab3b11d521004acc6d9168771736ec0a5f7c73ca78a46787c19299a79b453e49317353d6bee5b", 0x2000, &(0x7f0000009600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000903f5d34000020002b1f000a4a51f1ee839cd53400", 0x26) (async) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc)=0x1, 0x4) write(r0, &(0x7f0000000980)="a9", 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x160e) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) (async, rerun: 64) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='mountstats\x00') (rerun: 64) pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0xff) (async) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6tnl0\x00', r5, 0x2f, 0x0, 0x4, 0x3, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8000, 0x1, 0x9, 0x7fffffff}}) (async) syz_open_procfs(r3, 0x0) executing program 2: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) executing program 34: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 35: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) program crashed: WARNING in shmem_rmdir bisect: bisecting 28 programs bisect: split chunks (needed=false): <28> bisect: split chunk #0 of len 28 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 10, 30, 10, 6, 30, 5, 20, 30, 11, 22, 29, 25, 40, 19, 21, 40, 21] detailed listing: executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 32: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) poll(&(0x7f0000000140)=[{r0, 0x240}], 0x1, 0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x561}]}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000b10000400008000007"]) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r10 = openat(r9, &(0x7f00000001c0)='./file0\x00', 0x228082, 0x1) fcntl$lock(r10, 0x24, &(0x7f0000000200)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x928) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0, @ANYBLOB="01022abd7000fedbdf250f00000021000e006804020004007e15000403ffffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYBLOB="7a391670fc4a4e84132acb9e190403e146c841316fc4631c9aa062f25ca49bcb4ab6cfbb54a77af51bf33445a9f136ad3a8a7d81e2ae25f90f6452d2ef5c74806c7d9e69c6d94563f481f4848855aa247db96d83cac651a8bd3b13c0"], 0x68}, 0x1, 0x0, 0x0, 0x200480d0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0014"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="67f20f1c842600000000ea82b7240166b9970800000f32360f01c9660f38815d000f01bb47def40fb4333e0f00d2ea3a6ae200", 0x33}], 0x1, 0x1f, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3f) ioctl$KVM_SET_MSRS(r15, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff020000000000000500000000000039"]) executing program 2: ioprio_set$pid(0x1, 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) syz_io_uring_setup(0x2c4e, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x20000003}, 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1243, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003180)=ANY=[@ANYBLOB="38010000100013"], 0x138}, 0x1, 0x0, 0x0, 0x24000804}, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000b80)=0x2, 0x4) sendto$inet(r1, &(0x7f0000000740)="17fd8757270b23b5f2d12809a7b93d036023c20509d8d2b6d053b8944677c9d2ead3a8885db1d0bb7ec41c2f7d0604a4ed85f38d68f1813bb86c018a3c7139394bfecfee022378ce51bdc51590e0d0478f1c9d6d7a791512beb6cf73dcb86832cbe9c8a69532c088e59fdad44cd4a8ee00ed352d14e2ca413fa6d5c2377825b22b01d64fd9897acd4d7010ffff0000000000000ade8e2debdefc6dbd83a9c32eaa02d8c19fd73340054ef04a9799e1e4a3e1eb462a5f3f40312a7586fea68bf35d000e6bb666307ed85c77d20a2afc5a8d50a8db7e19825e7d54358e9377ea30027ab7c80746049c4aa2da53fac7e9940188b47402f4", 0x59a, 0x140080c0, 0x0, 0x20) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x100080, &(0x7f0000000140)=ANY=[@ANYBLOB="205d64653d303c3030303030303030307070f24c6973652c00"]) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000380)={[{@mode={'mode', 0x3d, 0xffffffff}}]}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f00000029c0)={0x2020}, 0x2020) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000005000000014d564b00000000af"]) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000180)=0x1, 0x4) syz_open_dev$usbfs(&(0x7f0000000000), 0xebdf, 0x5e7b02) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) syz_open_dev$loop(&(0x7f0000000080), 0x5, 0x200100) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) (async) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000300)={0x1}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents(r3, &(0x7f0000000200)=""/251, 0xfb) bind$vsock_stream(r3, 0x0, 0x0) getdents(r3, 0x0, 0x0) (async) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r9, 0x300000b, 0x11, r7, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r9, 0x3000002, 0x10, r4, 0x0) (async) r10 = syz_open_procfs(0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, 0x0) (async) fcntl$lock(r4, 0x7, &(0x7f0000000480)={0x1, 0x0, 0x10b, 0xfffffffffffffa8b}) (async) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) (async) syz_usb_control_io$hid(r11, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000005000/0x1000)=nil, 0x1000}, 0x5}) (async) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x2000) (async) prctl$PR_SET_MM_MAP(0x49, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000/0xb000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) (async) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r4, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000080)={0x100000, 0x105000, 0x1}) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x0, 0x3, 0x1, {0x400000000001, 0x180, 0x20ff, 0x6, 0x5, 0x3, 0x9, 0x3, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x1}}, {0x0, 0x13}}}, 0xa0) pread64(r1, 0x0, 0xbd5695353d88c232, 0x2) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, &(0x7f0000000100)=0x6e) accept4$unix(r5, 0x0, &(0x7f00000002c0), 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), 0xffffffffffffffff) futex(0x0, 0x2, 0x1, 0x0, 0x0, 0x1) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000840)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100aebd7000ffdbdf2501000000f9ff01800c000180080001000800000004000180"], 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, 0x0) executing program 3: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 2: r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) timerfd_create(0x9, 0x80800) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/3\x00') syz_fuse_handle_req(r1, &(0x7f0000002240)="26b2a8dd3bb50b8ceb62f430e5885746b5fd58b5a47a2bf28b373c8660a05cf8181b4b7a61b8ce127e9a2c0e92dea9379d5ca6b58c15037915bb4319621bdbead01cade5fc0535760d2286578af05881b83e2c2007508ed17ff1e44b5f91fd57e1077aaaf77b6741f58c4e426bb9b1ac269ddb81ba7c1d6ee457f1bb8ceb4e8a69db85ebb1df95fec7f3b5bd95dd726c920792e9a54f1641d5578f4347df0d583f76f962383980e8c6a1c123a70212d089e9b35900b052f0ee59eed7cf1e133398f5f5bd78d5c9820ee007f32894a57377a97af57c6d6dd108231b10a94c67f18552a65b870b7a9afcdfb72b57b81b1e424f739df21dfeebfaca906901b2626cfa482aabcc62b510255ee5010b4c1b260471011275c7f242659df63a8de398c2b0dfa67422e519853a439752898451f9f02defd4ae71ecc8aadd28d21a339d35cb425e109a5452d01d1ca2fc9cd2572a1252582d4b179876cc489b1b3fe4767d0356c29e6e0b891991f1dd5acc3c3e35f9d0048ed0e28b9771295729aeb5a1e262ec2fcbb545c3e24799bc424924294928312b42be902842083b4d7383ed289b307b66c8568277b3c17fea747ee49b750d83dd7ea1f18a5eae198451bd2968f823e03a4656cbbb154145465ddc7bcdd0c7b1d07366c0a4090e4023fd98d0f77d3949d7788bf0b31c52c7704bbfd681c4691d16ef610708ad2ae5af88301c5b0451ae9f292f16aa44230e53874a432be156fc74c9690983928aff88c8d817c86913fdc8425cf2cc43297e89321dfbbba3f4f1b8bcb602a17f1f5918c0657a9e0230f2722f2aca5f2f931c8c91dca589c02a711db5b7ca36f3a49282c4ec3b447ddcbb2f94e257a384d8c17980a3962b2c7b5c0b661899fd1451ce783dfb29355650454b65479ef40a319e37e90757ec3e3e08a2bbe0b9bed99d8bb31e5d240ffa66d5162748f30635658f92d864dc6ee1d95d9b6e19e554f6a4a5cb4a067b3c7d7d882ed4f908337febfd5cf00a6fd68e95fe62f5c374399f6d3201d3482a0637ac4d9d8253fbbf6bfdc3feb9db0a3d8a85cb337dc7a1328973e20bb82bcc2ec03a637f4f29e1efcf4fec09568a42ece4ee0508a0da8206989d12e522a65e76c4d64bbaec9f328b927391f2b15c7e8b3f138ef345afcac4d566448f327f84ed41f69b4d40c8309d9d5ed6846f788198e151a48f654d29b659f923858d443e118409541cea176cda5c518a938d10086148efdecda55cd4990922cffc06633c59db0c21d12e4b311e3858e82001c24c2225844019f9d633679ee75a70521da58cb8809c193c0f3389dcf540884ff0b44f224cbe03623ee16ad37e00abd1bdda5972379bfb097aa2ffe5e881ff988644b1364d8117feb6859fa4a942260aa6ac51387bc4c9173b8656813929744af772742e69d78f5b127b3ec8a64a3781a603a56e05eb948a003e54f3095e56899dc6413c4317e12141b3409ee8d33dc77ff33b10c5294c5e6b969848dee370c19e732f3e75a6bf21ad433c99d3978f8a8254fcc589eb067e3663e6179cd7904e080048565f0d8aae47d0dec7830d5eb48cd386ea8ff0cebf7bf86eda674cabd0d06f2068817d1d85f39bff655bda536ca5d9727545b8202a982818c388ab0219021fdf4dcdc5de8731edb03e9170a8867b614e5317f76f44c33563fabb73eb4cf8a766b6299e52d00646262e6e7704748a35322cdd7c52e6bae2654295f7804f68e807d5ce420213a278b751b360bffbc1bb9a027b98e65e9dab8fd143e02c2e6192eb8f411d80aad0fa5ff40ced48d26e076cda037ffed74f19b1a35839239b5d14e57fcba05aad705435f998d5a85c05d944bfc472ecda2974332b9b44c448365682d00e271f0fd2a436057adfb7b8eca4abdb8c1329121d6dae395dd1506a95c0de8191bd69cd1f68ec5af9a88fbb1a37c082b9df5cb390379f2db48c63e9f779b875ef9891a84181900bec4d6f512e4633f6b43b6abcb87e2e72f74d8cb0ea3019860339fdcff45dfe7e0817de819eef61d6e91b05a6b8ce8b0e1416e0210813429ff7a75cbd6e7a8f5c1e41012f8b092c6f0b45896a3de1a278b80104157dec7e210aab22aebb54ec881291fee48bc1c413f6a0704e45c1b00f39d4618147e4e11f429592bc92044a772bb33349d3ee4b6c2c5a5a8fdd5ad65434943c3987be2ab99807e23db8b9ec30a3030be076b7871c1bc7a9d4506f3a1e7b986d2ea1b60f9240db71a360c919dc6dc24f6af5878efd95d83f5a9529266f2fef29af2b60d214b21b6e3b8e5b3555849453f66e3b2fe46c2547690b745cf6b850312d825c73049a9a009d66d0d58801f254e2dc32897d9f3bf6fc3fd9ca6fef5d0f0dc55e85a99d735d1800f418010986d80f04e7f5a37109b73432db749b569966e781e646c0e373c94d7797960e1b73cb6cf58ffed290c567d7b5dc54f7a9c911d19fab72aded28cb7c063c46fd530b6ea9efef61c4da2bd5bad7d317743314ab01046b0f92d9d428a13bf5ff427fe25bdce29637f916b2da55f2f5ff05ea17002bf139a5740b7f2b60d6048844cc3909c76eb9ea0735ebed9c201efb8228245373c97d8c565e1ddb4c4d07c1ee7e3a942eea3cb88b2b263a0e4eef9b5cbc99f0b1fde017d01b15820f55f51d325c77c298b6973ad694b1f3bd5440fe8e8ea72fb10b53bbfb84c7d2b7be416df5cb60ad3607c71b387687752a119afb71cdc53b8a395e0398a5be4ac9a175df444ea715fbb2703911bcc6867a85ae2d76d25af06ed0e3688660dad6d69c1f356d43e655811e4169ff9f3f275a8417c44a9b7f5cc3e6ae05ed6a226da85946e84144191b4018d2a226e957e583fb34af3d4bdfbb59da087565fdd7faca17d652208c129549f16541f8addf7be170c6041459600364f025362ea0726f48cf82521d47eb478c341da8b0ba94e96942787d4046d04e86b3ecdbf4b3579aa8f00ca70e132609df358d9183f6cf6b200dfd16fac3e0bcdb13cc5bfb20bde3cc139967c70fefe3c39f484c442b75a5606a2b4952c799b04957e151d3dd76eeac764170a1929a88a668926fd6c22e9c2327f85fe88d388f4eed175a5c13e82bd6f42a7669341d2f3012c75c9871e419e0f3c7e50e347856415b8584eb2d2a0214d5bb03b10a26505ea9ffc7d5aca844e24af916eebe7513d8dd9145049aa0dd8e2a5a9fc53cef6239f56f2ba429601ead8223b5d89e5326e09f9d7c409a466fe5781435b9c324efc040cface76eb40b2da68b71a8baf2f916303726256c772cf27806d5208724cdf9f4eef7c7f3084a25242479fbe759bde637a7cb96d98510f0a68876d04cb47a3e7614b0b51f8812727b0881da22bf270d4a44206a581e71a7150c4096dc1fbd9e724ac572adfa13d6c2129e51df101bd5fd45bc57c356d67b65f270168bd0601e0241e887becb130fcb72c398c6e50d5123f5e8cef49d7ae92ae8e7de2221677a8aa6a285824ef679c68f87330224ce2c11299878adf4f46ed510fa4286f6110dd9965c189c21e85654d44992593ad75bb264fa4c9c7f600224b8eee14e6bac1aa0f9c9bc8c10caee2826cc6d8a787a9b98f908d062732ac0226268047fb44fd950d8ae380620c1f594a68a0813b492bfa3a8560dc1458ba84ddbf9b58f0f7317589a36c66493d1b1093c50719fe4e7b3a7f9dc61e961b0a36b0d65bd14029ad5b9dacdb4edbf090c2455c6c1af080e5447ec7aad8d1a532a48ce280decb70918738b3dcd49d3ffe16e1a2099f7e083aec3a97866e51d43e2581530e53d269c4ff2a6f576ecadc018f4e233b6e7da57130bdd369bdf5973031b7280d7bfcfc443dfb578de9d60be87e741e3aabedffd7b46e6a1c342661b0a122d579623e6e86e745e6ec3ee53545e9a1f63c1db363f68ee2a693a8f8bcd5f97c575db2ce1e03fee213bbd7a38a288fb83a07b1adeb99932fa55dda4b7e6be199f8f008abaa88c63f59179b47c541d8707709c7cd5f5aa5ed5c4dc63093596b09858952e64133cbe6b7d02b60528d6a263c9b72aa3e751a99e9fd1664121fc0ba9018d61011edd23d29d05c2080e33c721e503113be23973351a68fb5da582205a0e89e69fc84e24f3d4e8629847f9b6ba77e2ffe6ce394f99b1a94576c677e7433aa8bdc4d9779cbb706c6e2f426806d111173ffb0cd4f7be3ccffcfc9e66a16ab2806b6118ce28bc935624f1cbef0c9c4da396e6dc0e87ff20d0fd0e07d49327d8c0c97c7d70c50b584fbe563cde1cb17f36a73ebbe6b331b6321ac5ceba510a35ee913c5542a9d7b12805a29a99d25a5d3bc13a330435d6f0305bf522cc71e261c39d82584440d47fd82b9b31ad4ea0d2922558e6bab6fb6d3f6da9eb2a2e824af6928ee2ce41baee61fd4b5f896bf92bb1cf06c0c5a1b9b81a8216084c8e90451823d6be884a735a2be130304a22d8168c06db9cb6d62ba30079ecc831952f2564b760153311226d2188bc523928aa63223e785e6cf67a01962eed4195d5b06f06f272fe27d38660153c1727cfb438b5d98da5778070791c5ace1fd3ae756c8f261ad9d1c6aec5722a8e0609c3bb672c628879b65fbba3692070781c13bd34a93a5b9fff4f9ac4cd6aa3fdf076eeb4c0cfa14d2a41193e723d6d013995f34c97bd5d438eae8ca9a8a2dfdadec39c84c11cc9e9506020e072908178a6b60c53321c0b857d12b9adb58d90197c090e558d20a29bfd9f2ae297c23f47a544daa537f5780ec75b1824be5c92c20785499143252dd2f6d1f8aaf47deccbabf74ee0d55793b046aee7dc763353249f03cf2f0c60f6dd6ff082a051ffe2c8ef4ae9b1d8a046af67ffab68a4587ccd0a503906cca13aac0b7309d5fed12abd5303d2803f928651b51dd8747db79c56c3e3f89e6799a9dac3a7c57257c6575e133379b6c616dbab839b530e7ede62dc529acf5a6fa061fd1244fbc82d6e883388291ecaf1130151c8da538f8bccb9b871d2ce3417a9212ad94fe94c6e13e06975d8ba285d7e937ac4c6fd89aae06db06940670463d6b86a18856cc978a49f7e407f2e4f042d7ee1b7791cb33697824c68b2535af6c803e7940512da7db39c98ed1030e615569c200bc3ab833156187c25c1f659dcde3434f47a8cce56d821617c58907f80d5628214a0a8aad3fa2087647d52ac1c9692c6b57b85d70cd12875f110e631f3a9e34f21afc401797d9a13753deabb43fef92d691efb19a7120167f838d283fc5f2f1d7b4c2ef736fb1c8a47befcfd320f98461756d6908f00cea4a252733db78b6f67620e1a209e39f788a8360b8f42ccf1776259c6f70ef7ca2b0ee8caf4bf27017730236669eab62ada6db1d381ec2f8c60bebf555425bab9fa4d46823d3b0a1b1f51add64961aa2a073929116f02ea230bfb354019e47800415edeacf72a7daf8930c64adff306aba841fbe75bb18da73441721c86d3a70f9e6025e7fc95516703372fcae04421b08d0edbc5f1b6b6a3c66225011dc19f575111180e8d173922c2e28123347036b3ff2418dd529c49beb2e335801a3a5473c73d71d084c8271c10d86f283a659deaa57fff6673519645e0ee4c915cc3b8c440584fe222b1bc0cc0888142b9753ad409ed41ca16a92a3126ee73f7237523c6c781959fd255c5c0dff4ff324dc3e2246da77281809ead68df57e4ae6c1f8001e6d292e8e42f897b59770ec26b508ac5d57b47ee9696f9d40ceb39f9653a14737ede3f3213147381417d9633d30cc1107dde46e5ead6e4e4dec617202e10b9093e3bb2dfd785dd96a6a64f44bef7465552dc2e391c978c7ac1ce2b8f774d7b3934d15fc6d96eb3de6f0e9402a8538c6081712e5affa5b67b4153217b38f3248b2565c804226f4a31688d5fafacfe2e4fc191791c7164cfa33a474f4a9cd90fb5f37f5268e1801a2a762b00e8b7b2bda1db7a90ccc74ccc0fb015eb49a6ed0236d8b6b0e67bcaeeb750a499cfc3b2dc34e9024ea9bf00e5f0013a15509992979b50617dc14aeb0bac46c6961eca1e96ab2b45d342bc68e88b765a79d73f1eec58167e8ea4752981fd898f1ce528e9ba947723bd4d2ce228b6e5787227697d52f2bd0d4ecbebf5c6164f5819313060579ebb3ddb3c6423adb999975427c2d3da65b3cf52849c75464b46ede138be670742b175474222a47755f8006d4752b6c271643aa622f8439903abe53595792e7856a6e5a5e1b309fa139c2e64e927620c87aec8f36b9509c1d5cdee296bdde21d2cc54e7738070d93552d9ecd799325fe6fae9f3d7046ef1459d401922e3da284b7f6ef67ae196f274f6ce94887bb5ec25c0101618d6118b4cf47e0dfcb8dc89e8f44b47ba19c326db51a75a5b790620a2e460110dbc0f923a7d3825e4ac1d04597c0693fd05d93aabe907b47b1581f915de89c16580ae484f864e583b43ddc0991d716e401f60b6f62ebd52178a9e0adfbecc706dfffe8eee93f67ba2c9da4515bdfffd764741527ec04c3503da653271f2051ddad922ae38cae98c9a2eba5f8470d2551d2224add25a32b9c4d573f69ed15445d2b72ab20d1cd07c2d897dd7c97edab293db9f217a5eee5de9ad08da2f734e617b9f5268a3b91336237f5e9738a65f4adde4279eea09ce40e577b97eb5c67772e4ebee5a33afc7de28c70d97a514cdcd95908d26ad62800900a7cb9dcb88955b5401ccd4d965d00ebf0da48bf43cd2f5b61331894f523685b17beb253c3f50db89e11e664d6427a2551b5bfb2cbbfbf1e8240909d5eef23ccfa23d185391713d1205078be21e99063ff6316c06cd77969dda4d7f3350d4f2f29a23f12e14788fd60cbe4c3c00685a5e42b861597fd3b70c5e0e4d9f02355b754bf353fa2bd5dc0225080c26eb39be11a5b3cfe5264f39399167ab55ae7286f09c1d7fd0fc69bc9c7fca34867b5bf11c43612d3e010d2918a0d9b620549402f2c56e9cf3aa53b7614337f0867fe08170ffb272c5d340f237cdca3e023d2e65b250acf4f265ab8794a5388c5358d7e1cccbf82d99dd1aeba50f3363b9c3b6ac43542334bde8cf2ffd29da1d516bb5d950938f410829e2e37684916e1eac5c2ea1352e7cf6d0bc19bf16bf4ee61e44cd339fadcdf18126c46c0aba43c927510f3b876b32f606bfd2f657254e9715f8151099da8897c287ec1eb9077c72a0a31171f5e2672c16d3907caf659a73a15ec1bbdf240cf5796c22a99933999dd36ab3c354736b45b990e1631be048cad72829f782504ccff0cfc2e1eb5fb3e52e9fa4c3a39ec9ae7ef7b4b9e7e9a721a3f6addace5ca68d525ab9dc0d26b05333dd638bba4e40ec0a716b29172fc84a26c046dcdd0a744af3a7da0eb295a6b0d2a4e45bd6222464cae11bdb5a6c02f8ebb9c8846ca03175d4cab8b9c9531ae686029cc740c296feee12fda2cfb130808a3fd435c13bfca388ab530b8c4b546c4fc9af86596daec4569b5e82c8fd452731e27f9dffdc5713562b99fde6b59948a46f2a44ed0e539469040bb04a54fdf390f589c6491f1057b3d44573838dd2a1271ef8ccec3796012d2debeddb9dd0e252bf622f2671d6940f1c89b3ae38b4fcaa37103d96f4504c5654e603b80f710dc575bfdf2f4fa01741ab79057c15b627cd03e7dc24aab3ee312dd1d7e96731c28e24df9b051fa5972615858f07572d07f6a6f947fecf8acb05d220b68a4962b0bb9e2bb6341b97b0bfb18dc92764ceca8f723592c02104a020dfb9ff06bebc81ea80c68a1fa6175ab4042abd3305c1a17b72ba5491dc812def91672873fdd98632871ed0387e00a80c173b9e8c75e185149d32a9945e2f9707301c96337cd1c44cc13a9f38dc23720558c31c4cf6ff72559794c04af4deccbeddb04f267308e220963bf64d0aa830af54a91ae3ae0eb1aa3d48dde97ddd0916e3c16f4d90ef3e66f06f8c4c3d4fcfe41094708f49ac8d4e7150a74d9378a75018dba062fd1ec331776aafdb64e5e1732ab0f0ce0bd8985ec4b1374a6245b6d714a1c02ababcdc1fe22481a6ad3276662d4c9adf65e9d275afa6d57d6c3bcc6ab68234f4a1dade56c852c86c0bb4f427387bc9ea23e7361b7f518039af614141a12499b9602f95e2a969c7f31cf1056fe3b1954ecaa3db219f546a28e954964268be0296ea2765a8194d88b14869d388996d645f34511d63a602d92e795a0b29773052ce44b008556b6a0fb418a9233ed13edf3bda3db479211d00c16d40ee6321241d884fffeb3c1e2c01707c7aa387778779a241699ef4bd5d7cb8e40986539d0778cc242e98f17e630a09d62155b469ef5dba920d2ef80686c8f9eaf1965b42935d6dc470de7fbe0f5083a4b6ced2fa06b255fc35c3325bcc57ae3ef95ef58edb0b45bbff699de88afa565ab9f98b1c98255dfd6bd3eb18af00b94cbe5f94421b2828b0583c91e7cecd4754003ad8f46a206da99e75056705f9cccc481b591d4c33d96b21acbbdb4e70dfd9b6a2fccaa6a0af7f97fca9da759e62a6fb222341cbab0c808d320ff13a5989ce707aabd7f7c569b3e22e0c91613c483c136fb5b94ff7bdc1f51cbb9f5c46e4b62a19cca73057b78d1f3f8a9b0e2a20b8b8d9f2e8d0459df86c18353fbb3cb6e8b804e28dee571349e16b5df662cdedf1aa5a44eea00b778bc79c16138d85fab98c15ad9f2b83eebdb9432634280768397d2895c10012da8c6659e02295cfa52d6d06ef1e6ed0546d46c676048e5a455261659c83492d355eee56596e520962467fa8b3ae99cea9547d99a6d6b674682363c0dd5c8bd5c63d3bc2d45a94fb4e090ca27028b29a61c53d96ade29f1c60cffb5053b494dd2d7c7ccffc7006e16eb2bdcb360a1e0a3fa1f380616d0298e315808db7ae9ad16b6c4bb7dece5c2c4ba52d514f7fdc9b00e66302d1b6c6a7b5b58adb313e0cec67448238f66f69dd480d304a9831833a1b94f8109c0d2f85e646077bbaf140f9c7e72301d8e452f13711be18bdb48e2f0031c38da789a9e4161b7f0a6da09075414aaf9984ab7f141647c532e3b2530f3fd8a93b4218ecbbff44c4a58cdde1f9d89eb60ebe8033dc10116cbc09d4903bfd0830ef8b0d33572ce61bc028133be720544872e4a205fed6b005e8ed240ceb6e9efdd313b6eb0aed6bdcd335cb1765f2d7ed7f1819e0c04a8989183abcaa3677c35c33d95b139ed63f9f67e51386206ee2a3ad54bd4312b1178ece5a5a76eac9534faf2bb8c7b5105811a34a110553c63f1b9168ec5758e39d1f1baa4fd3e8dec73026c08ddf1568fa04b1a36a98055b6912f4faa0741e0bb5f063dfab6e6a8605b997affc69369980188967e4655c954d31b3ebea8dff5face904366191f0695fd3ccdc5e82c5982243e16a895f8aaf9d63d37ee1d323b296862ad265760a392378bc2ae5d7b75039b77aec33aa00c134f554ca9e5fd162296e915ccd359976e7ce4099bcaa5494c8eb6fa4da2a2e245920762f3639fa4fd4eb0e5e167a5f2111bfa669576ff3e0711a4ad78d2f8477363b03e6a13cd5b479817a62614ef613ac2b03a340114909c7b21ee93adf74c2ee2d4c666f1ab8bc43368e7643f3ea8da5a919b1e3078875228d2b519387ac49b7b9990d7dc229fb9ff0d551d3dfbeb843c8b2782f50cf8c575dec6836259a160a9a047165791d1e759c74ea65f4f9da990fc0e789bcd4ddf716442864788be6f2c5b607b6ddc7f9575b4e8375eea50e98cd9320fe736114e03aa0a2c1430d5cb507b29b388ace6ab58393513724607102a0458a458998e94d71b758df51ed4ecb6c6f2b94c31fb480745fbc6f6dc595c9558161fa14462779952982adb70d70a9f9a734fcbde17652e1a91422f93a6ff7d6c80fc92a5005bedf58aefe9bbba9d0ab3441e86b863bb5a3fdfd2a9c6f6d10717d2cd35d3c2a892f0e58545b1794d9aae993d72c215a6673bbe38976cc7d03cda84999c637aec8036ea1a23b143ed6288dcbc7d1ee487b1b6a4f6e8ef63b378acd4ff888bf95d86336907939c29695b2e0cc58efab49056f88a9027cad6d724e635f94f45f4cbddd8188608663ec7e46547e2aac7dec6cc5609e9f5f41ef26a1f16ecf6bfe200b0a955f98d9a4d41a2a268f8857670e33fbd4f076aa11c49cebd8306a4de3c86f7726fde93c7fc984079ae60e63854ee9a14162c749d7e308530c6b84cb5cafdd09ec3411cc0302c77d316beff973e3108ddb9b249e206d5476d605b7b24603ca344c2263bda8d7d3db55b9e2fcdce69be9b1ce24f8c4df129cd62a299fcbbff3309031973b5da452654c0b8ca4cf65891a8bdb8dedd20f631a34964e3bb0fa45c618861da79b259d79ecde8394061c99c661851c016c35ee8c91d52bbbc25f52b5e2f77ef2f63c764b717e8cce4d291742d5a7ef7f5d7ec1a96620eda1f962fb2448c388873f8b8abea4d27a5da092833c43c57c4b14099597f83785a31190798826f4264ba8f998cfbf7f20f9678e10e05c793f5781f8accca245d047d3be6c10541b2610c02c6e916d3db9776c6964e4519cf2e30708c954ef2492d3418c552dd9b5db4320dab8be6ac3394cb4b3fb1b9d5222c6ca9bd06aae2fef510e541db1209cde21fae56507020e80862d0b875d958346c42ebb781955ab337be61a68534281100247904b81b86aed49544c2452ecffaf6cc116f9d3c7362fc2cc390ab2ad29928b6e8bf90a4f21442fb213dbeeea4b8f481792fc6579b608e3a9c4fbe2755010d7ab3cd122de7a40a1f7780350a31d83ee5006ade36854cbc8e8c648259b29f2f7042719ab4d4d4d1f0c5fe6b717d23a5504335922f84ea8b20c78a5f1ddf6009089ea221353c01963fb8cabd3d795831c86d084660fa7f7d08f3ff15780c5b301ee27ab8d98fb358b90e92de4c96687c37e327ac1f0f23208c41a36e67cc22356df854f2dc309c110cfae51c5cc69051d22477caa1d2a2f276ccfbe907b263bd79ad4c5f6ea2687466f325ff2b1a736fff687c14d477c4c744e9c82be5b8ebfb69db2b312ff540ec8cadfcba9b609cae7e54ff347ed3d2649f9214600870ecba27f98943b4fb72f93b5ecb6d64dc1c7b2e8c2f2cf1006e39a237c5818014df9281feb6e522f6cb2d5ca35aeada09a58d5a6bdc9a75cf81a1c51faa8a3824a58d192a27be9fee5098b2e71d0d3f12917d50667415e418b790e0942260f4d2589c57aa1bd36017bd2bece963f0776f9f76cc66876c3f88f8bdbc35e329ecb56887948fd2c05d49c664509a682c6ff60350070bfd111be86ad2eee8c0d76b851fdb75f08e11fa47b5fd29b57568abbf91d3760652d475558bce2a1393688c9e2b4ae06cb072c294e1396b58db00b09ba8dbdc047a1684cca6e5b04cb52a40dd7b7f72c55292e7af0f3b8dda380d45b4e71c6cf57179247923750551ffd955f815cfbc29dfe5e0b2689eafdf44ce362b9c5864e4003326b2f183df7d39de7632bf3b2a85dca04cda08d10a5bad9ed9b481227e39804c3fd52d8a8f03288e13eb09c9075e23f82123a416e58864d95a321a719f88c8633201eb7d5c429348dfd83b476510f71808f95ab3b11d521004acc6d9168771736ec0a5f7c73ca78a46787c19299a79b453e49317353d6bee5b", 0x2000, &(0x7f0000009600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000903f5d34000020002b1f000a4a51f1ee839cd53400", 0x26) (async) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc)=0x1, 0x4) write(r0, &(0x7f0000000980)="a9", 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x160e) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) (async, rerun: 64) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='mountstats\x00') (rerun: 64) pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0xff) (async) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6tnl0\x00', r5, 0x2f, 0x0, 0x4, 0x3, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8000, 0x1, 0x9, 0x7fffffff}}) (async) syz_open_procfs(r3, 0x0) executing program 2: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) executing program 34: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 35: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 25, 40, 19, 21, 40, 21] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003180)=ANY=[@ANYBLOB="38010000100013"], 0x138}, 0x1, 0x0, 0x0, 0x24000804}, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000b80)=0x2, 0x4) sendto$inet(r1, &(0x7f0000000740)="17fd8757270b23b5f2d12809a7b93d036023c20509d8d2b6d053b8944677c9d2ead3a8885db1d0bb7ec41c2f7d0604a4ed85f38d68f1813bb86c018a3c7139394bfecfee022378ce51bdc51590e0d0478f1c9d6d7a791512beb6cf73dcb86832cbe9c8a69532c088e59fdad44cd4a8ee00ed352d14e2ca413fa6d5c2377825b22b01d64fd9897acd4d7010ffff0000000000000ade8e2debdefc6dbd83a9c32eaa02d8c19fd73340054ef04a9799e1e4a3e1eb462a5f3f40312a7586fea68bf35d000e6bb666307ed85c77d20a2afc5a8d50a8db7e19825e7d54358e9377ea30027ab7c80746049c4aa2da53fac7e9940188b47402f4", 0x59a, 0x140080c0, 0x0, 0x20) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x100080, &(0x7f0000000140)=ANY=[@ANYBLOB="205d64653d303c3030303030303030307070f24c6973652c00"]) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000380)={[{@mode={'mode', 0x3d, 0xffffffff}}]}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f00000029c0)={0x2020}, 0x2020) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000005000000014d564b00000000af"]) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000180)=0x1, 0x4) syz_open_dev$usbfs(&(0x7f0000000000), 0xebdf, 0x5e7b02) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) syz_open_dev$loop(&(0x7f0000000080), 0x5, 0x200100) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) (async) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000300)={0x1}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') getdents(r3, &(0x7f0000000200)=""/251, 0xfb) bind$vsock_stream(r3, 0x0, 0x0) getdents(r3, 0x0, 0x0) (async) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r9, 0x300000b, 0x11, r7, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r9, 0x3000002, 0x10, r4, 0x0) (async) r10 = syz_open_procfs(0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, 0x0) (async) fcntl$lock(r4, 0x7, &(0x7f0000000480)={0x1, 0x0, 0x10b, 0xfffffffffffffa8b}) (async) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) (async) syz_usb_control_io$hid(r11, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000005000/0x1000)=nil, 0x1000}, 0x5}) (async) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x2000) (async) prctl$PR_SET_MM_MAP(0x49, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000/0xb000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) (async) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x8000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r4, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r4, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000080)={0x100000, 0x105000, 0x1}) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x0, 0x3, 0x1, {0x400000000001, 0x180, 0x20ff, 0x6, 0x5, 0x3, 0x9, 0x3, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x1}}, {0x0, 0x13}}}, 0xa0) pread64(r1, 0x0, 0xbd5695353d88c232, 0x2) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, &(0x7f0000000100)=0x6e) accept4$unix(r5, 0x0, &(0x7f00000002c0), 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), 0xffffffffffffffff) futex(0x0, 0x2, 0x1, 0x0, 0x0, 0x1) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000840)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100aebd7000ffdbdf2501000000f9ff01800c000180080001000800000004000180"], 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x4000004) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, 0x0) executing program 3: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 2: r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) timerfd_create(0x9, 0x80800) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/3\x00') syz_fuse_handle_req(r1, &(0x7f0000002240)="26b2a8dd3bb50b8ceb62f430e5885746b5fd58b5a47a2bf28b373c8660a05cf8181b4b7a61b8ce127e9a2c0e92dea9379d5ca6b58c15037915bb4319621bdbead01cade5fc0535760d2286578af05881b83e2c2007508ed17ff1e44b5f91fd57e1077aaaf77b6741f58c4e426bb9b1ac269ddb81ba7c1d6ee457f1bb8ceb4e8a69db85ebb1df95fec7f3b5bd95dd726c920792e9a54f1641d5578f4347df0d583f76f962383980e8c6a1c123a70212d089e9b35900b052f0ee59eed7cf1e133398f5f5bd78d5c9820ee007f32894a57377a97af57c6d6dd108231b10a94c67f18552a65b870b7a9afcdfb72b57b81b1e424f739df21dfeebfaca906901b2626cfa482aabcc62b510255ee5010b4c1b260471011275c7f242659df63a8de398c2b0dfa67422e519853a439752898451f9f02defd4ae71ecc8aadd28d21a339d35cb425e109a5452d01d1ca2fc9cd2572a1252582d4b179876cc489b1b3fe4767d0356c29e6e0b891991f1dd5acc3c3e35f9d0048ed0e28b9771295729aeb5a1e262ec2fcbb545c3e24799bc424924294928312b42be902842083b4d7383ed289b307b66c8568277b3c17fea747ee49b750d83dd7ea1f18a5eae198451bd2968f823e03a4656cbbb154145465ddc7bcdd0c7b1d07366c0a4090e4023fd98d0f77d3949d7788bf0b31c52c7704bbfd681c4691d16ef610708ad2ae5af88301c5b0451ae9f292f16aa44230e53874a432be156fc74c9690983928aff88c8d817c86913fdc8425cf2cc43297e89321dfbbba3f4f1b8bcb602a17f1f5918c0657a9e0230f2722f2aca5f2f931c8c91dca589c02a711db5b7ca36f3a49282c4ec3b447ddcbb2f94e257a384d8c17980a3962b2c7b5c0b661899fd1451ce783dfb29355650454b65479ef40a319e37e90757ec3e3e08a2bbe0b9bed99d8bb31e5d240ffa66d5162748f30635658f92d864dc6ee1d95d9b6e19e554f6a4a5cb4a067b3c7d7d882ed4f908337febfd5cf00a6fd68e95fe62f5c374399f6d3201d3482a0637ac4d9d8253fbbf6bfdc3feb9db0a3d8a85cb337dc7a1328973e20bb82bcc2ec03a637f4f29e1efcf4fec09568a42ece4ee0508a0da8206989d12e522a65e76c4d64bbaec9f328b927391f2b15c7e8b3f138ef345afcac4d566448f327f84ed41f69b4d40c8309d9d5ed6846f788198e151a48f654d29b659f923858d443e118409541cea176cda5c518a938d10086148efdecda55cd4990922cffc06633c59db0c21d12e4b311e3858e82001c24c2225844019f9d633679ee75a70521da58cb8809c193c0f3389dcf540884ff0b44f224cbe03623ee16ad37e00abd1bdda5972379bfb097aa2ffe5e881ff988644b1364d8117feb6859fa4a942260aa6ac51387bc4c9173b8656813929744af772742e69d78f5b127b3ec8a64a3781a603a56e05eb948a003e54f3095e56899dc6413c4317e12141b3409ee8d33dc77ff33b10c5294c5e6b969848dee370c19e732f3e75a6bf21ad433c99d3978f8a8254fcc589eb067e3663e6179cd7904e080048565f0d8aae47d0dec7830d5eb48cd386ea8ff0cebf7bf86eda674cabd0d06f2068817d1d85f39bff655bda536ca5d9727545b8202a982818c388ab0219021fdf4dcdc5de8731edb03e9170a8867b614e5317f76f44c33563fabb73eb4cf8a766b6299e52d00646262e6e7704748a35322cdd7c52e6bae2654295f7804f68e807d5ce420213a278b751b360bffbc1bb9a027b98e65e9dab8fd143e02c2e6192eb8f411d80aad0fa5ff40ced48d26e076cda037ffed74f19b1a35839239b5d14e57fcba05aad705435f998d5a85c05d944bfc472ecda2974332b9b44c448365682d00e271f0fd2a436057adfb7b8eca4abdb8c1329121d6dae395dd1506a95c0de8191bd69cd1f68ec5af9a88fbb1a37c082b9df5cb390379f2db48c63e9f779b875ef9891a84181900bec4d6f512e4633f6b43b6abcb87e2e72f74d8cb0ea3019860339fdcff45dfe7e0817de819eef61d6e91b05a6b8ce8b0e1416e0210813429ff7a75cbd6e7a8f5c1e41012f8b092c6f0b45896a3de1a278b80104157dec7e210aab22aebb54ec881291fee48bc1c413f6a0704e45c1b00f39d4618147e4e11f429592bc92044a772bb33349d3ee4b6c2c5a5a8fdd5ad65434943c3987be2ab99807e23db8b9ec30a3030be076b7871c1bc7a9d4506f3a1e7b986d2ea1b60f9240db71a360c919dc6dc24f6af5878efd95d83f5a9529266f2fef29af2b60d214b21b6e3b8e5b3555849453f66e3b2fe46c2547690b745cf6b850312d825c73049a9a009d66d0d58801f254e2dc32897d9f3bf6fc3fd9ca6fef5d0f0dc55e85a99d735d1800f418010986d80f04e7f5a37109b73432db749b569966e781e646c0e373c94d7797960e1b73cb6cf58ffed290c567d7b5dc54f7a9c911d19fab72aded28cb7c063c46fd530b6ea9efef61c4da2bd5bad7d317743314ab01046b0f92d9d428a13bf5ff427fe25bdce29637f916b2da55f2f5ff05ea17002bf139a5740b7f2b60d6048844cc3909c76eb9ea0735ebed9c201efb8228245373c97d8c565e1ddb4c4d07c1ee7e3a942eea3cb88b2b263a0e4eef9b5cbc99f0b1fde017d01b15820f55f51d325c77c298b6973ad694b1f3bd5440fe8e8ea72fb10b53bbfb84c7d2b7be416df5cb60ad3607c71b387687752a119afb71cdc53b8a395e0398a5be4ac9a175df444ea715fbb2703911bcc6867a85ae2d76d25af06ed0e3688660dad6d69c1f356d43e655811e4169ff9f3f275a8417c44a9b7f5cc3e6ae05ed6a226da85946e84144191b4018d2a226e957e583fb34af3d4bdfbb59da087565fdd7faca17d652208c129549f16541f8addf7be170c6041459600364f025362ea0726f48cf82521d47eb478c341da8b0ba94e96942787d4046d04e86b3ecdbf4b3579aa8f00ca70e132609df358d9183f6cf6b200dfd16fac3e0bcdb13cc5bfb20bde3cc139967c70fefe3c39f484c442b75a5606a2b4952c799b04957e151d3dd76eeac764170a1929a88a668926fd6c22e9c2327f85fe88d388f4eed175a5c13e82bd6f42a7669341d2f3012c75c9871e419e0f3c7e50e347856415b8584eb2d2a0214d5bb03b10a26505ea9ffc7d5aca844e24af916eebe7513d8dd9145049aa0dd8e2a5a9fc53cef6239f56f2ba429601ead8223b5d89e5326e09f9d7c409a466fe5781435b9c324efc040cface76eb40b2da68b71a8baf2f916303726256c772cf27806d5208724cdf9f4eef7c7f3084a25242479fbe759bde637a7cb96d98510f0a68876d04cb47a3e7614b0b51f8812727b0881da22bf270d4a44206a581e71a7150c4096dc1fbd9e724ac572adfa13d6c2129e51df101bd5fd45bc57c356d67b65f270168bd0601e0241e887becb130fcb72c398c6e50d5123f5e8cef49d7ae92ae8e7de2221677a8aa6a285824ef679c68f87330224ce2c11299878adf4f46ed510fa4286f6110dd9965c189c21e85654d44992593ad75bb264fa4c9c7f600224b8eee14e6bac1aa0f9c9bc8c10caee2826cc6d8a787a9b98f908d062732ac0226268047fb44fd950d8ae380620c1f594a68a0813b492bfa3a8560dc1458ba84ddbf9b58f0f7317589a36c66493d1b1093c50719fe4e7b3a7f9dc61e961b0a36b0d65bd14029ad5b9dacdb4edbf090c2455c6c1af080e5447ec7aad8d1a532a48ce280decb70918738b3dcd49d3ffe16e1a2099f7e083aec3a97866e51d43e2581530e53d269c4ff2a6f576ecadc018f4e233b6e7da57130bdd369bdf5973031b7280d7bfcfc443dfb578de9d60be87e741e3aabedffd7b46e6a1c342661b0a122d579623e6e86e745e6ec3ee53545e9a1f63c1db363f68ee2a693a8f8bcd5f97c575db2ce1e03fee213bbd7a38a288fb83a07b1adeb99932fa55dda4b7e6be199f8f008abaa88c63f59179b47c541d8707709c7cd5f5aa5ed5c4dc63093596b09858952e64133cbe6b7d02b60528d6a263c9b72aa3e751a99e9fd1664121fc0ba9018d61011edd23d29d05c2080e33c721e503113be23973351a68fb5da582205a0e89e69fc84e24f3d4e8629847f9b6ba77e2ffe6ce394f99b1a94576c677e7433aa8bdc4d9779cbb706c6e2f426806d111173ffb0cd4f7be3ccffcfc9e66a16ab2806b6118ce28bc935624f1cbef0c9c4da396e6dc0e87ff20d0fd0e07d49327d8c0c97c7d70c50b584fbe563cde1cb17f36a73ebbe6b331b6321ac5ceba510a35ee913c5542a9d7b12805a29a99d25a5d3bc13a330435d6f0305bf522cc71e261c39d82584440d47fd82b9b31ad4ea0d2922558e6bab6fb6d3f6da9eb2a2e824af6928ee2ce41baee61fd4b5f896bf92bb1cf06c0c5a1b9b81a8216084c8e90451823d6be884a735a2be130304a22d8168c06db9cb6d62ba30079ecc831952f2564b760153311226d2188bc523928aa63223e785e6cf67a01962eed4195d5b06f06f272fe27d38660153c1727cfb438b5d98da5778070791c5ace1fd3ae756c8f261ad9d1c6aec5722a8e0609c3bb672c628879b65fbba3692070781c13bd34a93a5b9fff4f9ac4cd6aa3fdf076eeb4c0cfa14d2a41193e723d6d013995f34c97bd5d438eae8ca9a8a2dfdadec39c84c11cc9e9506020e072908178a6b60c53321c0b857d12b9adb58d90197c090e558d20a29bfd9f2ae297c23f47a544daa537f5780ec75b1824be5c92c20785499143252dd2f6d1f8aaf47deccbabf74ee0d55793b046aee7dc763353249f03cf2f0c60f6dd6ff082a051ffe2c8ef4ae9b1d8a046af67ffab68a4587ccd0a503906cca13aac0b7309d5fed12abd5303d2803f928651b51dd8747db79c56c3e3f89e6799a9dac3a7c57257c6575e133379b6c616dbab839b530e7ede62dc529acf5a6fa061fd1244fbc82d6e883388291ecaf1130151c8da538f8bccb9b871d2ce3417a9212ad94fe94c6e13e06975d8ba285d7e937ac4c6fd89aae06db06940670463d6b86a18856cc978a49f7e407f2e4f042d7ee1b7791cb33697824c68b2535af6c803e7940512da7db39c98ed1030e615569c200bc3ab833156187c25c1f659dcde3434f47a8cce56d821617c58907f80d5628214a0a8aad3fa2087647d52ac1c9692c6b57b85d70cd12875f110e631f3a9e34f21afc401797d9a13753deabb43fef92d691efb19a7120167f838d283fc5f2f1d7b4c2ef736fb1c8a47befcfd320f98461756d6908f00cea4a252733db78b6f67620e1a209e39f788a8360b8f42ccf1776259c6f70ef7ca2b0ee8caf4bf27017730236669eab62ada6db1d381ec2f8c60bebf555425bab9fa4d46823d3b0a1b1f51add64961aa2a073929116f02ea230bfb354019e47800415edeacf72a7daf8930c64adff306aba841fbe75bb18da73441721c86d3a70f9e6025e7fc95516703372fcae04421b08d0edbc5f1b6b6a3c66225011dc19f575111180e8d173922c2e28123347036b3ff2418dd529c49beb2e335801a3a5473c73d71d084c8271c10d86f283a659deaa57fff6673519645e0ee4c915cc3b8c440584fe222b1bc0cc0888142b9753ad409ed41ca16a92a3126ee73f7237523c6c781959fd255c5c0dff4ff324dc3e2246da77281809ead68df57e4ae6c1f8001e6d292e8e42f897b59770ec26b508ac5d57b47ee9696f9d40ceb39f9653a14737ede3f3213147381417d9633d30cc1107dde46e5ead6e4e4dec617202e10b9093e3bb2dfd785dd96a6a64f44bef7465552dc2e391c978c7ac1ce2b8f774d7b3934d15fc6d96eb3de6f0e9402a8538c6081712e5affa5b67b4153217b38f3248b2565c804226f4a31688d5fafacfe2e4fc191791c7164cfa33a474f4a9cd90fb5f37f5268e1801a2a762b00e8b7b2bda1db7a90ccc74ccc0fb015eb49a6ed0236d8b6b0e67bcaeeb750a499cfc3b2dc34e9024ea9bf00e5f0013a15509992979b50617dc14aeb0bac46c6961eca1e96ab2b45d342bc68e88b765a79d73f1eec58167e8ea4752981fd898f1ce528e9ba947723bd4d2ce228b6e5787227697d52f2bd0d4ecbebf5c6164f5819313060579ebb3ddb3c6423adb999975427c2d3da65b3cf52849c75464b46ede138be670742b175474222a47755f8006d4752b6c271643aa622f8439903abe53595792e7856a6e5a5e1b309fa139c2e64e927620c87aec8f36b9509c1d5cdee296bdde21d2cc54e7738070d93552d9ecd799325fe6fae9f3d7046ef1459d401922e3da284b7f6ef67ae196f274f6ce94887bb5ec25c0101618d6118b4cf47e0dfcb8dc89e8f44b47ba19c326db51a75a5b790620a2e460110dbc0f923a7d3825e4ac1d04597c0693fd05d93aabe907b47b1581f915de89c16580ae484f864e583b43ddc0991d716e401f60b6f62ebd52178a9e0adfbecc706dfffe8eee93f67ba2c9da4515bdfffd764741527ec04c3503da653271f2051ddad922ae38cae98c9a2eba5f8470d2551d2224add25a32b9c4d573f69ed15445d2b72ab20d1cd07c2d897dd7c97edab293db9f217a5eee5de9ad08da2f734e617b9f5268a3b91336237f5e9738a65f4adde4279eea09ce40e577b97eb5c67772e4ebee5a33afc7de28c70d97a514cdcd95908d26ad62800900a7cb9dcb88955b5401ccd4d965d00ebf0da48bf43cd2f5b61331894f523685b17beb253c3f50db89e11e664d6427a2551b5bfb2cbbfbf1e8240909d5eef23ccfa23d185391713d1205078be21e99063ff6316c06cd77969dda4d7f3350d4f2f29a23f12e14788fd60cbe4c3c00685a5e42b861597fd3b70c5e0e4d9f02355b754bf353fa2bd5dc0225080c26eb39be11a5b3cfe5264f39399167ab55ae7286f09c1d7fd0fc69bc9c7fca34867b5bf11c43612d3e010d2918a0d9b620549402f2c56e9cf3aa53b7614337f0867fe08170ffb272c5d340f237cdca3e023d2e65b250acf4f265ab8794a5388c5358d7e1cccbf82d99dd1aeba50f3363b9c3b6ac43542334bde8cf2ffd29da1d516bb5d950938f410829e2e37684916e1eac5c2ea1352e7cf6d0bc19bf16bf4ee61e44cd339fadcdf18126c46c0aba43c927510f3b876b32f606bfd2f657254e9715f8151099da8897c287ec1eb9077c72a0a31171f5e2672c16d3907caf659a73a15ec1bbdf240cf5796c22a99933999dd36ab3c354736b45b990e1631be048cad72829f782504ccff0cfc2e1eb5fb3e52e9fa4c3a39ec9ae7ef7b4b9e7e9a721a3f6addace5ca68d525ab9dc0d26b05333dd638bba4e40ec0a716b29172fc84a26c046dcdd0a744af3a7da0eb295a6b0d2a4e45bd6222464cae11bdb5a6c02f8ebb9c8846ca03175d4cab8b9c9531ae686029cc740c296feee12fda2cfb130808a3fd435c13bfca388ab530b8c4b546c4fc9af86596daec4569b5e82c8fd452731e27f9dffdc5713562b99fde6b59948a46f2a44ed0e539469040bb04a54fdf390f589c6491f1057b3d44573838dd2a1271ef8ccec3796012d2debeddb9dd0e252bf622f2671d6940f1c89b3ae38b4fcaa37103d96f4504c5654e603b80f710dc575bfdf2f4fa01741ab79057c15b627cd03e7dc24aab3ee312dd1d7e96731c28e24df9b051fa5972615858f07572d07f6a6f947fecf8acb05d220b68a4962b0bb9e2bb6341b97b0bfb18dc92764ceca8f723592c02104a020dfb9ff06bebc81ea80c68a1fa6175ab4042abd3305c1a17b72ba5491dc812def91672873fdd98632871ed0387e00a80c173b9e8c75e185149d32a9945e2f9707301c96337cd1c44cc13a9f38dc23720558c31c4cf6ff72559794c04af4deccbeddb04f267308e220963bf64d0aa830af54a91ae3ae0eb1aa3d48dde97ddd0916e3c16f4d90ef3e66f06f8c4c3d4fcfe41094708f49ac8d4e7150a74d9378a75018dba062fd1ec331776aafdb64e5e1732ab0f0ce0bd8985ec4b1374a6245b6d714a1c02ababcdc1fe22481a6ad3276662d4c9adf65e9d275afa6d57d6c3bcc6ab68234f4a1dade56c852c86c0bb4f427387bc9ea23e7361b7f518039af614141a12499b9602f95e2a969c7f31cf1056fe3b1954ecaa3db219f546a28e954964268be0296ea2765a8194d88b14869d388996d645f34511d63a602d92e795a0b29773052ce44b008556b6a0fb418a9233ed13edf3bda3db479211d00c16d40ee6321241d884fffeb3c1e2c01707c7aa387778779a241699ef4bd5d7cb8e40986539d0778cc242e98f17e630a09d62155b469ef5dba920d2ef80686c8f9eaf1965b42935d6dc470de7fbe0f5083a4b6ced2fa06b255fc35c3325bcc57ae3ef95ef58edb0b45bbff699de88afa565ab9f98b1c98255dfd6bd3eb18af00b94cbe5f94421b2828b0583c91e7cecd4754003ad8f46a206da99e75056705f9cccc481b591d4c33d96b21acbbdb4e70dfd9b6a2fccaa6a0af7f97fca9da759e62a6fb222341cbab0c808d320ff13a5989ce707aabd7f7c569b3e22e0c91613c483c136fb5b94ff7bdc1f51cbb9f5c46e4b62a19cca73057b78d1f3f8a9b0e2a20b8b8d9f2e8d0459df86c18353fbb3cb6e8b804e28dee571349e16b5df662cdedf1aa5a44eea00b778bc79c16138d85fab98c15ad9f2b83eebdb9432634280768397d2895c10012da8c6659e02295cfa52d6d06ef1e6ed0546d46c676048e5a455261659c83492d355eee56596e520962467fa8b3ae99cea9547d99a6d6b674682363c0dd5c8bd5c63d3bc2d45a94fb4e090ca27028b29a61c53d96ade29f1c60cffb5053b494dd2d7c7ccffc7006e16eb2bdcb360a1e0a3fa1f380616d0298e315808db7ae9ad16b6c4bb7dece5c2c4ba52d514f7fdc9b00e66302d1b6c6a7b5b58adb313e0cec67448238f66f69dd480d304a9831833a1b94f8109c0d2f85e646077bbaf140f9c7e72301d8e452f13711be18bdb48e2f0031c38da789a9e4161b7f0a6da09075414aaf9984ab7f141647c532e3b2530f3fd8a93b4218ecbbff44c4a58cdde1f9d89eb60ebe8033dc10116cbc09d4903bfd0830ef8b0d33572ce61bc028133be720544872e4a205fed6b005e8ed240ceb6e9efdd313b6eb0aed6bdcd335cb1765f2d7ed7f1819e0c04a8989183abcaa3677c35c33d95b139ed63f9f67e51386206ee2a3ad54bd4312b1178ece5a5a76eac9534faf2bb8c7b5105811a34a110553c63f1b9168ec5758e39d1f1baa4fd3e8dec73026c08ddf1568fa04b1a36a98055b6912f4faa0741e0bb5f063dfab6e6a8605b997affc69369980188967e4655c954d31b3ebea8dff5face904366191f0695fd3ccdc5e82c5982243e16a895f8aaf9d63d37ee1d323b296862ad265760a392378bc2ae5d7b75039b77aec33aa00c134f554ca9e5fd162296e915ccd359976e7ce4099bcaa5494c8eb6fa4da2a2e245920762f3639fa4fd4eb0e5e167a5f2111bfa669576ff3e0711a4ad78d2f8477363b03e6a13cd5b479817a62614ef613ac2b03a340114909c7b21ee93adf74c2ee2d4c666f1ab8bc43368e7643f3ea8da5a919b1e3078875228d2b519387ac49b7b9990d7dc229fb9ff0d551d3dfbeb843c8b2782f50cf8c575dec6836259a160a9a047165791d1e759c74ea65f4f9da990fc0e789bcd4ddf716442864788be6f2c5b607b6ddc7f9575b4e8375eea50e98cd9320fe736114e03aa0a2c1430d5cb507b29b388ace6ab58393513724607102a0458a458998e94d71b758df51ed4ecb6c6f2b94c31fb480745fbc6f6dc595c9558161fa14462779952982adb70d70a9f9a734fcbde17652e1a91422f93a6ff7d6c80fc92a5005bedf58aefe9bbba9d0ab3441e86b863bb5a3fdfd2a9c6f6d10717d2cd35d3c2a892f0e58545b1794d9aae993d72c215a6673bbe38976cc7d03cda84999c637aec8036ea1a23b143ed6288dcbc7d1ee487b1b6a4f6e8ef63b378acd4ff888bf95d86336907939c29695b2e0cc58efab49056f88a9027cad6d724e635f94f45f4cbddd8188608663ec7e46547e2aac7dec6cc5609e9f5f41ef26a1f16ecf6bfe200b0a955f98d9a4d41a2a268f8857670e33fbd4f076aa11c49cebd8306a4de3c86f7726fde93c7fc984079ae60e63854ee9a14162c749d7e308530c6b84cb5cafdd09ec3411cc0302c77d316beff973e3108ddb9b249e206d5476d605b7b24603ca344c2263bda8d7d3db55b9e2fcdce69be9b1ce24f8c4df129cd62a299fcbbff3309031973b5da452654c0b8ca4cf65891a8bdb8dedd20f631a34964e3bb0fa45c618861da79b259d79ecde8394061c99c661851c016c35ee8c91d52bbbc25f52b5e2f77ef2f63c764b717e8cce4d291742d5a7ef7f5d7ec1a96620eda1f962fb2448c388873f8b8abea4d27a5da092833c43c57c4b14099597f83785a31190798826f4264ba8f998cfbf7f20f9678e10e05c793f5781f8accca245d047d3be6c10541b2610c02c6e916d3db9776c6964e4519cf2e30708c954ef2492d3418c552dd9b5db4320dab8be6ac3394cb4b3fb1b9d5222c6ca9bd06aae2fef510e541db1209cde21fae56507020e80862d0b875d958346c42ebb781955ab337be61a68534281100247904b81b86aed49544c2452ecffaf6cc116f9d3c7362fc2cc390ab2ad29928b6e8bf90a4f21442fb213dbeeea4b8f481792fc6579b608e3a9c4fbe2755010d7ab3cd122de7a40a1f7780350a31d83ee5006ade36854cbc8e8c648259b29f2f7042719ab4d4d4d1f0c5fe6b717d23a5504335922f84ea8b20c78a5f1ddf6009089ea221353c01963fb8cabd3d795831c86d084660fa7f7d08f3ff15780c5b301ee27ab8d98fb358b90e92de4c96687c37e327ac1f0f23208c41a36e67cc22356df854f2dc309c110cfae51c5cc69051d22477caa1d2a2f276ccfbe907b263bd79ad4c5f6ea2687466f325ff2b1a736fff687c14d477c4c744e9c82be5b8ebfb69db2b312ff540ec8cadfcba9b609cae7e54ff347ed3d2649f9214600870ecba27f98943b4fb72f93b5ecb6d64dc1c7b2e8c2f2cf1006e39a237c5818014df9281feb6e522f6cb2d5ca35aeada09a58d5a6bdc9a75cf81a1c51faa8a3824a58d192a27be9fee5098b2e71d0d3f12917d50667415e418b790e0942260f4d2589c57aa1bd36017bd2bece963f0776f9f76cc66876c3f88f8bdbc35e329ecb56887948fd2c05d49c664509a682c6ff60350070bfd111be86ad2eee8c0d76b851fdb75f08e11fa47b5fd29b57568abbf91d3760652d475558bce2a1393688c9e2b4ae06cb072c294e1396b58db00b09ba8dbdc047a1684cca6e5b04cb52a40dd7b7f72c55292e7af0f3b8dda380d45b4e71c6cf57179247923750551ffd955f815cfbc29dfe5e0b2689eafdf44ce362b9c5864e4003326b2f183df7d39de7632bf3b2a85dca04cda08d10a5bad9ed9b481227e39804c3fd52d8a8f03288e13eb09c9075e23f82123a416e58864d95a321a719f88c8633201eb7d5c429348dfd83b476510f71808f95ab3b11d521004acc6d9168771736ec0a5f7c73ca78a46787c19299a79b453e49317353d6bee5b", 0x2000, &(0x7f0000009600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000903f5d34000020002b1f000a4a51f1ee839cd53400", 0x26) (async) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc)=0x1, 0x4) write(r0, &(0x7f0000000980)="a9", 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x160e) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) (async, rerun: 64) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='mountstats\x00') (rerun: 64) pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0xff) (async) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6tnl0\x00', r5, 0x2f, 0x0, 0x4, 0x3, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8000, 0x1, 0x9, 0x7fffffff}}) (async) syz_open_procfs(r3, 0x0) executing program 2: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) executing program 34: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) lseek(r0, 0xfbb6, 0x1) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000665000/0x3000)=nil, 0x3000, 0x3000004, 0x12, r0, 0x99b33000) mprotect(&(0x7f0000538000/0x2000)=nil, 0x2000, 0xd) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) (async) setsockopt$sock_timeval(r2, 0x1, 0x43, &(0x7f0000000040)={0x0, 0xea60}, 0x10) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40000) socket(0x840000000002, 0x3, 0x100) (async) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x57, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000080), 0x0) (async) writev(r5, &(0x7f0000000080), 0x0) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) (async) sendmmsg$inet6(r3, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="00ae1122784a3e55a82e48db50d93ea31f3b99ef866cc0965a19ec411f1526060000000000000095c30ff6cc96de9c57", 0x30}], 0x1}}], 0x1, 0xab2a4b1689bb5014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000001, 0x13, r1, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) (async) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f00000000c0)=0x300, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0x0, &(0x7f0000000780)={0x11, 0x0, 0x80}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, &(0x7f0000000100)={0x10000000006, 0x6, 0x0, 0x1, 0x0, [0x10b022, 0xfffffffe, 0x2, 0xc4]}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r9, 0xc00c55ca, &(0x7f00000001c0)={0x200000a, 0xfffffffa, 0x6}) executing program 35: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a40, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000300)=ANY=[], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x0, {0x4}}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r3, &(0x7f0000000480)={0x18, 0xfffffffffffffff5}, 0x18) syz_usb_connect(0x0, 0x4b, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003f9aab106d04f0080d500102030109023900010000164709040000030806620009050700000000000009"], 0x0) write$FUSE_INIT(r3, &(0x7f0000000600)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3, 0x0, 0x4, 0x53b, 0x7, 0x0, 0x0, 0x0, 0xa0, 0x200}}, 0x50) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x80, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x23c201, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x12, r4, 0x75e7f000) write$FUSE_INIT(r4, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1282, 0x400c6001, 0x5, 0x8, 0x10, 0xc40b, 0x0, 0x0, 0x40, 0x6}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4204, r5, 0x2, &(0x7f0000000040)={0x0}) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 10, 30, 10, 6, 30, 5, 20, 30, 11] detailed listing: executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 32: r0 = socket$inet6(0xa, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000140)={[0x20000000003, 0x80, 0x6, 0x6, 0xfffffffffffffffd, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x40080, 0x4000000000000007, 0x7f, 0x8000000000000002, 0x6, 0xfffffffffffffffd, 0xffffffffffffaa72], 0x8000000, 0x3e0602}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x7, 0xae}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = memfd_secret(0x0) r5 = socket$inet_icmp(0x2, 0x2, 0x1) close_range(r4, r5, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r5, 0xf504, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x141342, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x4}, 0x0) splice(r0, &(0x7f00000000c0)=0x3, r0, &(0x7f0000000100)=0x1eb, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x305e) r7 = open(&(0x7f0000000080)='./bus\x00', 0x4a003, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d0012800800210015be55cb98bad637bdfd767c0ad7432af4ced0482241972997ceffc0f5c39bd3cfd2b818e1ffe0c9f254c26ce6e752fcfc3646d7c38c051e207509e20719e0f1665a500286683d52331924c0ee2e4572c1ff2eb491d339f91870f642d9bfe1f0f6faa8d7a83ea11b6ca95940e96f31f23196c2bdcda727d81e1cab6bd0f53349cc171cb2bd17f4df7e9ef60f4caa2bff53730389bd361a3835a556f7e33d366a11bce29e3719ba8261683c2254eadcfeea0d7fe6ff688d0794593ab050b9", @ANYRES32=0x0, @ANYBLOB="428184a477201ac90f24d8c531680464a01e08554baff2279134e2a452c739471e1c7bd4aef903f973120a8762bddc1900f269ce3068ee8401e0199c9cf16ed3db00000020010680190175800800e600", @ANYRES32=r8, @ANYBLOB="897a22072687e16fdfb849e8dd3bce220a0ca5a0217c43a621fc12ea0f434990fb1debcbb8e87383381132856180c51cf041d37410e5c77c74341ca2fb3527623d0d2d2bc75c54319aadb5a0bf07015b904d89c47e56d4a00a4d5513d73c8f790a8c6205fc5adf3ece36d8bf098573c2ec8b3967135a4bcb4b37bbfc8f6f11a6125f87dedb659579fb127e221eb9a41ce6664ff427973789c92dbadbc1c26802fd2a7e6d3152396176640025805d005b800400388031ee704bf2205ac750d21a6c2f2dfbe2ec632ee97444c6e5508eecb0d002fed7244664b012fdb29ccd21c6e14a7fd67239cda477572049ea051a00e88008009900", @ANYRES32=0x0, @ANYBLOB="8cda759849b5a66f654f3e332a3d0000000000000000"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x804) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f00000003c0)={0xd8}) syz_io_uring_setup(0xd07, &(0x7f00000002c0)={0x0, 0xc5f8, 0x100, 0x1, 0xc3, 0x0, r7}, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./bus\x00') sendfile(r6, r6, 0x0, 0x7ffff000) executing program 33: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000000180)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d07}]}) (async, rerun: 32) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000000)={0x1001, 0x403}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) poll(&(0x7f0000000140)=[{r0, 0x240}], 0x1, 0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x561}]}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000b10000400008000007"]) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r10 = openat(r9, &(0x7f00000001c0)='./file0\x00', 0x228082, 0x1) fcntl$lock(r10, 0x24, &(0x7f0000000200)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x928) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0, @ANYBLOB="01022abd7000fedbdf250f00000021000e006804020004007e15000403ffffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYBLOB="7a391670fc4a4e84132acb9e190403e146c841316fc4631c9aa062f25ca49bcb4ab6cfbb54a77af51bf33445a9f136ad3a8a7d81e2ae25f90f6452d2ef5c74806c7d9e69c6d94563f481f4848855aa247db96d83cac651a8bd3b13c0"], 0x68}, 0x1, 0x0, 0x0, 0x200480d0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0014"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="67f20f1c842600000000ea82b7240166b9970800000f32360f01c9660f38815d000f01bb47def40fb4333e0f00d2ea3a6ae200", 0x33}], 0x1, 0x1f, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3f) ioctl$KVM_SET_MSRS(r15, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff020000000000000500000000000039"]) executing program 2: ioprio_set$pid(0x1, 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) syz_io_uring_setup(0x2c4e, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x20000003}, 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1243, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 5, 20, 30, 11] detailed listing: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x561}]}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000b10000400008000007"]) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r10 = openat(r9, &(0x7f00000001c0)='./file0\x00', 0x228082, 0x1) fcntl$lock(r10, 0x24, &(0x7f0000000200)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x928) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0, @ANYBLOB="01022abd7000fedbdf250f00000021000e006804020004007e15000403ffffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYBLOB="7a391670fc4a4e84132acb9e190403e146c841316fc4631c9aa062f25ca49bcb4ab6cfbb54a77af51bf33445a9f136ad3a8a7d81e2ae25f90f6452d2ef5c74806c7d9e69c6d94563f481f4848855aa247db96d83cac651a8bd3b13c0"], 0x68}, 0x1, 0x0, 0x0, 0x200480d0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0014"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="67f20f1c842600000000ea82b7240166b9970800000f32360f01c9660f38815d000f01bb47def40fb4333e0f00d2ea3a6ae200", 0x33}], 0x1, 0x1f, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3f) ioctl$KVM_SET_MSRS(r15, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff020000000000000500000000000039"]) executing program 2: ioprio_set$pid(0x1, 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) syz_io_uring_setup(0x2c4e, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x20000003}, 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1243, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 11] detailed listing: executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x561}]}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000b10000400008000007"]) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r10 = openat(r9, &(0x7f00000001c0)='./file0\x00', 0x228082, 0x1) fcntl$lock(r10, 0x24, &(0x7f0000000200)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x928) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16=0x0, @ANYBLOB="01022abd7000fedbdf250f00000021000e006804020004007e15000403ffffffffff"], 0x38}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32, @ANYBLOB="7a391670fc4a4e84132acb9e190403e146c841316fc4631c9aa062f25ca49bcb4ab6cfbb54a77af51bf33445a9f136ad3a8a7d81e2ae25f90f6452d2ef5c74806c7d9e69c6d94563f481f4848855aa247db96d83cac651a8bd3b13c0"], 0x68}, 0x1, 0x0, 0x0, 0x200480d0}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0014"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="67f20f1c842600000000ea82b7240166b9970800000f32360f01c9660f38815d000f01bb47def40fb4333e0f00d2ea3a6ae200", 0x33}], 0x1, 0x1f, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3f) ioctl$KVM_SET_MSRS(r15, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff020000000000000500000000000039"]) executing program 2: ioprio_set$pid(0x1, 0x0, 0x0) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2020) syz_io_uring_setup(0x2c4e, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x20000003}, 0x0, 0x0) r1 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1243, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 5, 20] detailed listing: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-socket$packet-socketpair$tipc-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-socket$xdp-setsockopt$XDP_UMEM_COMPLETION_RING-socket$inet6_udplite-setsockopt$XDP_RX_RING-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-setsockopt$XDP_UMEM_FILL_RING-bind$xdp-close_range-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-mmap$binder-ioprio_set$uid-openat$cgroup_subtree-write$cgroup_subtree-ioctl$BINDER_WRITE_READ detailed listing: executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r7, 0x0) ioprio_set$uid(0x0, 0x0, 0x2007) r8 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000180)={[{0x2d, 'net'}]}, 0x5) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 5] detailed listing: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-setuid-mmap-mremap-mlock detailed listing: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) setuid(0xee00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x2000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000b0e000/0x4000)=nil, 0x4000) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_tcp_TCP_ULP-ioctl$KVM_SET_REGS detailed listing: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 3: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_tcp_TCP_ULP-ioctl$KVM_SET_REGS detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 30 syscalls minimizing guilty program testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_tcp_TCP_ULP detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6 detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp-setsockopt$inet6_tcp_int detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap-socket$inet6_tcp detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-mmap detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r6, 0xfae18000) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv-openat$kvm detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p-readv detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84800) readv(r3, &(0x7f00000008c0), 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb-pipe2$9p detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) pipe2$9p(&(0x7f00000003c0), 0x84800) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs-openat$rnullb detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap-syz_open_dev$usbfs detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fd, 0x82) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root-mmap detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r1, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs-mkdirat$cgroup_root detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir-openat$binderfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs-chdir detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-move_mount detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-open_tree-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-mkdir-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) move_mount(0xffffffffffffffff, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-symlinkat-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mknodat-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mmap-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7ffffffff000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-setsockopt$bt_BT_DEFER_SETUP-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x24) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-listen-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) listen(r0, 0x8000) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_init_net_socket$bt_l2cap-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, 0x0, 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', 0x0, &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=43.236464302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program did not crash testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program did not crash testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program did not crash testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.236464302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-open_tree-move_mount-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 2h11m31.789936761s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 360 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 360 Comm: syz-executor Not tainted 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 cf 55 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 98 9a 03 cc e8 92 5a 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000168fc60 EFLAGS: 00010293 RAX: ffffffff81ed474e RBX: ffff888128089e30 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fc88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520002d1f7c R12: dffffc0000000000 R13: 1ffff110250113cf R14: ffff888128089e78 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555897874e8 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3733 vfs_rmdir+0x3dd/0x560 fs/namei.c:4340 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/360 CPU: 1 UID: 0 PID: 360 Comm: syz-executor Tainted: G W 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x10c/0x190 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:491 kasan_report+0x163/0x1a0 mm/kasan/report.c:601 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x299/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4353 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001134e1067 P4D 80000001134e1067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 360 Comm: syz-executor Tainted: G B W 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 7d 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 8d RSP: 0018:ffffc9000168fca0 EFLAGS: 00010246 RAX: ffff88810ef8a600 RBX: 0000000000000000 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff888128089e3c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4353 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 7d 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 8d RSP: 0018:ffffc9000168fca0 EFLAGS: 00010246 RAX: ffff88810ef8a600 RBX: 0000000000000000 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff888128089e3c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 7d 51 98 ff call 0xff985190 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 8c 4c ee ff call 0xffee4cb0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 8d .byte 0x8d final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 360 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 360 Comm: syz-executor Not tainted 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 cf 55 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 98 9a 03 cc e8 92 5a 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000168fc60 EFLAGS: 00010293 RAX: ffffffff81ed474e RBX: ffff888128089e30 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fc88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520002d1f7c R12: dffffc0000000000 R13: 1ffff110250113cf R14: ffff888128089e78 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555897874e8 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3733 vfs_rmdir+0x3dd/0x560 fs/namei.c:4340 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/360 CPU: 1 UID: 0 PID: 360 Comm: syz-executor Tainted: G W 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x10c/0x190 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:491 kasan_report+0x163/0x1a0 mm/kasan/report.c:601 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x299/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4353 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001134e1067 P4D 80000001134e1067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 360 Comm: syz-executor Tainted: G B W 6.12.30-syzkaller-g68f4f0b0690a #0 d2d57a621586a6800997b547ec5ef233d70fc6ad Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 7d 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 8d RSP: 0018:ffffc9000168fca0 EFLAGS: 00010246 RAX: ffff88810ef8a600 RBX: 0000000000000000 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff888128089e3c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x26a/0x560 fs/namei.c:4353 incfs_kill_sb+0x109/0x230 fs/incfs/vfs.c:1968 deactivate_locked_super+0xd8/0x2a0 fs/super.c:476 deactivate_super+0xb8/0xe0 fs/super.c:509 cleanup_mnt+0x3f1/0x480 fs/namespace.c:1374 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1381 task_work_run+0x1e0/0x250 kernel/task_work.c:240 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f765b78fc57 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc4dc57c48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f765b78fc57 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc4dc57d00 RBP: 00007ffc4dc57d00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc4dc58d90 R13: 00007f765b810925 R14: 0000000000007491 R15: 00007ffc4dc58dd0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 7d 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 8d RSP: 0018:ffffc9000168fca0 EFLAGS: 00010246 RAX: ffff88810ef8a600 RBX: 0000000000000000 RCX: ffff88810ef8a600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000168fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff888128089e3c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555589764500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000110e4a000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 7d 51 98 ff call 0xff985190 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 8c 4c ee ff call 0xffee4cb0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 8d .byte 0x8d