Extracting prog: 35m17.35581174s Minimizing prog: 8m2.479357098s Simplifying prog options: 3m47.022067907s Extracting C: 49.283571406s Simplifying C: 0s extracting reproducer from 25 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-recvmsg-sendmsg$tipc-syz_ublk_setup_io_uring-syz_ublk_add_dev-bind$tipc-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_SET_NODE_ADDR-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_DEL_KEY-sendmsg detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, 0x0, 0x0) sendmsg$tipc(r0, 0x0, 0x20008081) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r7, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="51b0250c0000000800030000000000000000", @ANYRES32=r9, @ANYBLOB="0c009900faffffff6b0000000a000600ffffffffffff0000200050800800070003000000090001007fe022d63c000000080007000100000004002800"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x8000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$inet6_tcp-memfd_create-pipe2-splice-close_range-sendmsg$nl_generic detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$inet6_tcp-memfd_create-pipe2-splice-close_range-sendmsg$nl_generic detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-socket$inet6_udp-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_tcp_TCP_ULP-setsockopt$inet6_tcp_TLS_TX-write$binfmt_script-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-timer_create-close_range-sendmsg$inet6 detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0xc0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000300)=@gcm_128={{0x304}, "793ba630b2de12f8", "c638280e9b39583cc7fd269640bc0334", "36ebbafd", "cf5506fd54cac505"}, 0x28) write$binfmt_script(r3, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x1007}]}) timer_create(0x2, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$inet6(r2, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffc, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000700)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x2}}}, @dstopts_2292={{0x18, 0x29, 0x3b}}, @hoplimit={{0x14, 0x29, 0x34, 0x9}}], 0x48}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$key-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_BASE-ioctl$VHOST_SET_LOG_FD-ioctl$VHOST_SET_VRING_KICK-ioctl$VHOST_SET_VRING_ADDR-ioctl$VHOST_SET_VRING_ADDR-ioctl$VHOST_SET_MEM_TABLE-ioctl$VHOST_VSOCK_SET_RUNNING-ioctl$BTRFS_IOC_SCRUB_PROGRESS-mprotect-syz_usb_connect detailed listing: executing program 0: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30, 4, 10, 33, 19, 10, 14, 16, 30, 30, 8, 15, 16, 30, 6, 14, 18, 14, 25, 4, 15, 7, 7, 13] detailed listing: executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0xa400, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000140)={0x600000000000000, 0x40000, 0x0, 0x8, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0x11, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r4, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000001980)=[{0x0, 0xdd12}], 0x1}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0xdddd1000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0x10000, 0x9, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0x0, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x8000000, 0x0, 0x0, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffffffffe, 0xd801, 0x0, [0x0, 0x0, 0x1]}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x7, 0xfe, 0xe1, 0x0, 0x6, 0xd9, 0x40, 0x1, 0xfb, 0x8, 0xc, 0x0, 0x0, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x0, 0x20, 0x3, 0x0, 0x106c, 0x80000001, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x0, 0x8001], 0x1, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x0, @private=0xa010100, 0x4e24, 0x0, 'lblc\x00', 0x10, 0x8d, 0x1d}, 0x2c) ioctl$EXT4_IOC_GETSTATE(0xffffffffffffffff, 0x40046629, &(0x7f0000000040)) (async) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000080)=[@nested_vmlaunch={0x12f, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0xb64}}, @nested_amd_clgi={0x17f, 0x10}, @nested_load_syzos={0x136, 0xb4, {0x3, 0x5, [@nested_load_code={0x12e, 0x5c, {0x3, "f30fc772b0f3ae66b876000f00d0c461a5e170060f79445c0eb9cc020000b8ce000000ba000000000f30f20fd05fdd420f78ad4f470000c48175fe631326660ff37c8406"}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x537, 0x5, 0x1fb3, 0x7fffffff}}]}}, @nested_amd_stgi={0x17e, 0x10}, @nested_create_vm={0x12d, 0x18}], 0x11c}) ioctl$KVM_CAP_HYPERV_SYNIC2(r0, 0x4068aea3, &(0x7f0000000200)) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000280)=0xf9) (async) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r0, 0x4068aea3, &(0x7f00000002c0)) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000340), 0x2, 0x111040) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000380)={0x37e3, 0x13, [{0xa, 0x1}, {0xa, 0x1}, {0x8}, {0x7}, {0x1}, {0xa}, {0x5, 0x1}, {0xe, 0x1}, {0xb, 0x1}, {}, {0xd}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x8, 0x1}, {0x1, 0x1}, {0xe, 0x1}, {0x3}, {0x2, 0x1}]}) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET_FEATURE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x3fa, 0x400, 0x70bd25, 0x25dfdbff, {0x1, 0x1, 0x1, 0x1}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x80) mmap$usbfs(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x30, r1, 0x5f89) (async) mmap$usbfs(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000000, 0x31, r1, 0x71) (async) r3 = memfd_secret(0x0) ioctl$KVM_NMI(r3, 0xae9a) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500), r3) sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8806}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xc4, r4, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff71}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfff8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5ad}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5f5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffc0}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20008051}, 0x800) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wpan3\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) (rerun: 32) sendmsg$NL802154_CMD_NEW_SEC_DEV(r5, &(0x7f0000000900)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0x90, r6, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVICE={0xc, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0xb}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_DEVICE={0x40, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6}, @NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0x2}, @NL802154_DEV_ATTR_PAN_ID={0x6}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xffff}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x80) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000980), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x20, r10, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x66}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x44090) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000b80)={&(0x7f0000000b40)=[{&(0x7f0000000a80)="3bdcf97de6d0666e9a51108bdd7bd3bf655616719623717edae1be4a82678cf2a9e3087b18c297a87a993995b4f192f0e79d3eff6d9a0f75806ba8f98b8bf4bf32b1ed61", 0x44}, {&(0x7f0000000b00)="446c6d3a86e0a2fdbd7b6c6c71e449fb97ebd746418db4", 0x17}], 0x2, 0x8, 0x0, 0x8697, 0x5b32, 0x2, 0x3, 0xf}) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000c00)) (async, rerun: 64) r11 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000fc0)={0x0, &(0x7f0000000c40)=[@uexit={0x0, 0x18, 0xc24f}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x4fe, 0x5, 0xd8, 0x4}}, @cpuid={0x64, 0x18, {0x4, 0x10000}}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xa6, 0x6, 0x7, 0x1}}, @cpuid={0x64, 0x18, {0x5, 0x7}}, @wr_drn={0x68, 0x20, {0x6, 0x6}}, @rdmsr={0x66, 0x18, {0x22e}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0xcd17}, @nested_vmresume={0x130, 0x18, 0x1}, @wr_drn={0x68, 0x20, {0x7, 0x7}}, @wrmsr={0x65, 0x20, {0xa3f, 0x8000000000000000}}, @code={0xa, 0x50, {"b9800000c00f3235010000000f30660f3880410cf3420f01798d440f01cb0f9683530000002e2e66430f62ef660faef30f20c035200000000f22c067a70f08"}}, @cpuid={0x64, 0x18, {0x3, 0x4}}, @out_dx={0x6a, 0x28, {0x463d, 0x6, 0x2}}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_load_code={0x12e, 0x6b, {0x1, "0f20e035000002000f22e0450f783066bad104ecb805000000b9070000000f01c166b80c010f00d866baf80cb8a065198eef66bafc0c66ed650fc7b806880000263e420f01c2f30f2ac4c4c13575bd1f626c99"}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xb05a, 0x7ff, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x482, 0x8, 0xfffffffffffffff9, 0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x808, 0x9, 0x9, 0x2c32}}], 0x36b}) (rerun: 64) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000001040)=@arm64_sve={0x6080000000150488, &(0x7f0000001000)=0x1}) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4001af83, 0x0) syz_usb_connect$uac1(0x3, 0x87, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000002082050c004000010203010902750003010600950904000000010100000a2401d4000a00020102090401000001020000090401010101020000072401f5f900000e2402030604b1020c47148017f309050109100007010c07250104070400090402000001029f89c965ea4570000009040201010102"], 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000180)={@initdev, @dev}, &(0x7f0000000280)=0xc) (rerun: 32) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) (async) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x64, r4, 0x4, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x1, 0x34}}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x100}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x18, 0x2d, 0x0, 0x1, [{0x14, 0x0, @random="32a910e3c2ed2d0038d7e9a178734127"}]}, @NL80211_ATTR_SCAN_SSIDS={0x1c, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0xff000000}]}, 0x64}, 0x1, 0x0, 0x0, 0x811}, 0x8001) (async) recvfrom$inet(r2, 0x0, 0x0, 0x1, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="20000080", @ANYRES16=r1, @ANYBLOB="21032bbd7000fcdbdf25040000000c0001800800030003000000"], 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) setgroups(0x0, 0x0) (async) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000080)=[0xee00]) setregid(r3, r3) (async) setregid(r3, r3) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff}) fchdir(r5) (async) fchdir(r5) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) (async) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) r6 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f00009ef000/0x400000)=nil) setuid(0xee00) syz_kvm_add_vcpu$x86(r6, &(0x7f0000000180)={0x0, 0x0}) getpgrp(0x0) (async) r7 = getpgrp(0x0) syz_pidfd_open(r7, 0x0) (async) syz_pidfd_open(r7, 0x0) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') (async) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') clock_gettime(0x0, &(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000580)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000008440)=[{{&(0x7f0000000040)=@nfc_llcp, 0x80, &(0x7f0000000880)=[{&(0x7f00000001c0)=""/216, 0xd8}, {&(0x7f00000002c0)=""/46, 0x2e}, {&(0x7f0000000300)=""/202, 0xca}, {&(0x7f00000005c0)=""/166, 0xa6}, {&(0x7f0000000680)=""/242, 0xf2}, {&(0x7f0000000780)=""/133, 0x85}, {&(0x7f0000000840)=""/54, 0x36}], 0x7}, 0x1ff}, {{&(0x7f0000000900)=@alg, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000980)}, {&(0x7f00000009c0)=""/207, 0xcf}, {&(0x7f0000000ac0)=""/154, 0x9a}], 0x3, &(0x7f0000000440)=""/204, 0xcc}, 0x7ff}, {{&(0x7f0000000cc0)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000000d40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/114, 0x72}, {&(0x7f0000001dc0)=""/75, 0x4b}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/221, 0xdd}], 0x5, &(0x7f0000002fc0)=""/112, 0x70}, 0x7}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f0000003040)=""/162, 0xa2}, {&(0x7f0000003100)=""/106, 0x6a}, {&(0x7f0000003180)=""/9, 0x9}, {&(0x7f00000031c0)=""/4096, 0x1000}, {&(0x7f00000041c0)=""/233, 0xe9}, {&(0x7f00000042c0)=""/224, 0xe0}, {&(0x7f00000043c0), 0x33}, {&(0x7f0000000bc0)=""/21, 0xf}, {&(0x7f0000004440)=""/238, 0xee}], 0x9, &(0x7f0000004600)=""/39, 0x27}, 0x7}, {{&(0x7f0000004640)=@xdp, 0x80, &(0x7f0000004840)=[{&(0x7f00000046c0)=""/166, 0xa6}, {&(0x7f0000004780)=""/151, 0x97}], 0x2, &(0x7f0000004880)=""/209, 0xd1}, 0x9}, {{&(0x7f0000004980)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000004a00)=""/176, 0xb0}, {&(0x7f0000004ac0)=""/221, 0xdd}, {&(0x7f0000004bc0)=""/222, 0xde}, {&(0x7f0000004cc0)=""/120, 0x78}, {&(0x7f0000004d40)=""/99, 0x63}], 0x5}, 0xfffffc00}, {{&(0x7f0000004e40)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000004ec0)=""/4096, 0x1000}, {&(0x7f0000005ec0)=""/4096, 0x1000}], 0x2, &(0x7f0000006f00)=""/189, 0xbd}, 0x401}, {{0x0, 0x0, &(0x7f0000008180)=[{&(0x7f0000006fc0)=""/25, 0x19}, {&(0x7f0000007000)=""/110, 0x6e}, {&(0x7f0000007080)=""/4096, 0x1000}, {&(0x7f0000000980)=""/33, 0xfffffffffffffcd3}, {&(0x7f00000080c0)=""/178, 0xb2}], 0x5, &(0x7f0000008200)=""/127, 0x7f}, 0xffffff99}, {{&(0x7f0000008280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000083c0)=[{&(0x7f0000008300)=""/126, 0x7e}, {&(0x7f0000008380)=""/27, 0x1b}], 0x2, &(0x7f0000008400)=""/42, 0x2a}, 0x20}], 0x9, 0x100, &(0x7f0000008680)={r8, r9+60000000}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000086c0)=ANY=[@ANYBLOB="54010000100033060000000000000000fe8000000000000000000000000000aaffffffff000000000000000000000000000040000000800400000000870000008792b3fb71e9dd6682007a6eeb5d6bb0a11c0d730b1d923544e3fb58896bd9f30f6c444052475643042c9ea65f771e6c612d29f254a677a996b9c30cfa10", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14143f0000000000000000000000000000000032000000fe80000000000000000000000000003f2703000000000000090008000000000000000000000000000400000000000000ff0f00000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008f000000000000000800000029bd70000000000002000100000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040002005e2100000000ac14143f00"/268], 0x154}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000008d00)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000008cc0)={&(0x7f0000008880)=ANY=[@ANYBLOB="140400004100000425bd7000fddbdf250f000000080098800400d7800c001900070000000000000041000980f99cfbfeb22d74ebf640d9fb411027a99daff104007380267b80c40b0edfe486cc0c00190004000000000000000c005500000000000000e7680400588000000008004d800400398019022e80a0005000d137aeba257b37999d81b545df8765d2cee0d5ac19139ef99a9d80e95d44f66d1572cd873004c019659983dfc8cccad35e63e3255946d3867721ae827f6bd7fb96a64512edb55e0fe42ec04fda1e42f6f3307c95d26b15168472b1682ee6eefea3d98eb8037a1c23874fd6f22a18e40ac28b087c960c67383d61acbb89ddec0212566fe46f2bd294e42386bc78d66f56a8f8a03f98cd2ba84761e108266d4c488939e2594e59599d10ea5b365c15a2b055423713e196ba552f9afafc236429c1b12497c22e93e81aade50397e5a61bf1c212e5da88a1d18ca764cfd4628f6eb93b0f77d44bf694d235d95ac56ec301e03fceb884314eef1ee7bf0747df178b8de90ee73bb7913c640c565b5db0f88b903b1acef5614d8c671918ce40cab2129c13186885faec99fe6103e120905fbd74e7bc71ee055cd3d8380f14b1ab3a685e73712dd799cdeee19800edea4dbdbb846e211bdf3f8d45e83e839c48c8392bf3bcd169b2952bd5775469b039fdccf3c17180869e040047806f470f03d9eb569c7e895bdecd2dbf778e823f9bd6784fbb01d5e1cf1b52be780bd7bea418b7404b399dcd0b8848b5633cc4d1b6f464e4ced593269d3ccdebbcbd04bb25d164facdd56078235dad234aefa37fdf5aa70c4fb9a1b38d0a8cfd561fab8e90a25bd2ac420be41a9d4fccbba0e115bde191bbec12f5d5d36136253c40535daaed59acc5b921e7f654251a819943d41f3e18181d070000004201868014002600ff010000000000000000000000000001f03d18ee7a42d5c0287770bcc4b6a665a70f8ea576efe1459f4a7d69389ca57338f31e0ba2d1251e15abbb0d6472f5e14cc9ed566fe99cf36fcbe569dc7dc12ed0b4dad71a0a7d32c86e2d8394e94bbdb0a8afa1d397d7efb2e6fe70929caf6c3fbaeeb25b80c768a18191caa8cc51d441f7e69fc56fe139bdada2bb91cf033d18ea2e10978c55080034007f00000146e1a828e4bb6ab1458b4ab742d0aa06677aee36027f818340da7a61e9156e130f88cdcbae67b610a71a367bed3d69f7a869cb8a3d4c1af7336b42552ce9b5f7f07a6bda4d59ce51826e76deb9a925e80d342e7f466b05e5330adf19569e1156e80caa96682dd0ca41ae77b332db304700572064e5877414007700ff0100000000000000000000000000010400358008004200", @ANYRES32, @ANYBLOB="040065800000f1d1cfc68a6cdd7ea2b8714cc51f66500a017e41343f23b41b231adc796d64c5d04be7ec5bdf596bf0aedb0a919a0e0d51df052e137008002a00ffffffff0000"], 0x414}, 0x1, 0x0, 0x0, 0x20040800}, 0x1) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) setuid(0xee01) close(0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x0, 0x8, 0x0, 0x3}, 0x18, [0x5, 0x80, 0xfffffff0, 0x457, 0x2, 0x10, 0xffff, 0x7fffffff, 0x5, 0x8, 0xfffffffb, 0x5, 0x8235, 0x0, 0x1000, 0xd1c, 0x3, 0x9f5, 0x6, 0x2, 0x97, 0x3, 0x82c9, 0x9, 0x5, 0xfffffffc, 0x5, 0x1, 0x1, 0x2, 0x6, 0x3, 0x8, 0x7, 0xb, 0x101, 0x8, 0x6, 0x7e8, 0x0, 0x8c7, 0x190b, 0x3ff, 0x8, 0x4979, 0x16d2, 0x3764, 0x10000, 0x6, 0xb, 0xffffff83, 0x6, 0x6, 0x6, 0x7, 0x80, 0x1, 0x4, 0x44a, 0xffffffff, 0x6, 0x414, 0x1, 0x6], [0x80, 0x2, 0x2, 0x100, 0x9, 0x1, 0x400, 0x3, 0x7f, 0x8, 0x9, 0x5, 0xea, 0x1, 0x7, 0x9, 0x8, 0x80, 0x4a8e8b3f, 0x4, 0xa, 0x1ff, 0x5, 0x4, 0x7, 0x7fffffff, 0x4, 0x800, 0x40, 0xd1f0, 0x9, 0x6, 0x9, 0xf, 0x5, 0xf65b, 0x5, 0x6, 0x6, 0x6, 0xfffffff8, 0x2, 0x2, 0xe, 0x8, 0x8ea4, 0x5, 0x9, 0xd10a, 0xf506, 0x1, 0x2, 0x3, 0x5, 0x4, 0x4, 0x0, 0x3, 0x8, 0x3, 0xb, 0x4, 0x1000, 0x59e8], [0x5, 0xdb4, 0x70274e6d, 0x0, 0x3, 0x0, 0x6, 0x800, 0x47, 0x7, 0x5, 0x4, 0xb, 0x2, 0x7f, 0x3, 0xd, 0xff, 0x4, 0x9, 0x7, 0xff, 0x3, 0x1, 0xfcfbfc7, 0x2, 0x776f, 0xb, 0x6, 0x5, 0xffffffff, 0x5, 0x8bc3, 0x5, 0xd4, 0x3, 0x6, 0x2, 0x6, 0x8, 0x8000, 0x7, 0x7, 0x101, 0x3, 0x3, 0x1, 0x4, 0x7fffffff, 0x7ff, 0x7, 0x5, 0xd, 0x7, 0x5, 0x5, 0x9, 0x7, 0x2, 0x400, 0x1d, 0x2, 0xffff149c, 0x6], [0x80, 0x4, 0x800, 0x9, 0x4, 0x1ff, 0x8, 0xb8f2, 0xb, 0x1, 0x8, 0x6ea, 0x7, 0x8bc4, 0x94c, 0x10001, 0x1ff, 0x5, 0x334f, 0x8001, 0xfe000000, 0x9, 0x7, 0x5, 0x0, 0x8, 0x1, 0x3, 0x80000000, 0x6, 0x4, 0x1, 0x5, 0x9, 0x6e000000, 0x2, 0x2, 0x8, 0x6711, 0x9, 0x6, 0xfffffffc, 0x7, 0x10000, 0x101, 0x8, 0xfffffffa, 0xffff68d8, 0x80000000, 0x4, 0x80000000, 0x3, 0xea, 0xffffffff, 0x0, 0x4, 0x2, 0x5, 0xfffff468, 0x8, 0x2, 0x2, 0x3, 0xfffffffb]}, 0x45c) syslog(0x4, &(0x7f0000000640)=""/167, 0xa7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000100)="0f01cf0f01ca660f3881a1007066b9800000c00f326635010000000f30b800008ed8ba2100b039ee66b9490200000f32f4660f3817d00f01ca", 0x39}], 0x1, 0x31, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x6) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xfffe, 0xe57, @empty}, 0x1c) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000240)={0x60, 0x4000000, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x4, 0x0, 0x0, 0x8, 0x40, 0x15, 0x4d}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="836bb66f", 0x5ac, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x8f, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109027d0003010880000904000000010100000a240101801f00020102092403020003010008c80524050308090401000001020000090401010101020000082402010201090709050109600201060c0725010c01060009040200000102000009040201010102000009058209ff03db085e07250100061c00"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x72, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040010}, 0x80) (async) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x40001, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, &(0x7f00000000c0)=0x104, 0x4) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001"], 0xfdef) (async) r11 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r12 = dup(r11) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = dup(r6) ioctl$PTP_EXTTS_REQUEST2(r14, 0xc0603d06, &(0x7f0000000040)={0x200}) (async) ptrace(0x8, r0) syz_usb_connect$midi(0x3, 0x59, &(0x7f0000001f80)=ANY=[@ANYRES8=r1, @ANYBLOB="343fc0c99291f0869161e84d8093cf44530b4466b27115d9e455c1eda5a374dc44401c030880c1771d33b6e8aa0778cdd2f8fcf7965b1a32f22fb2438d72dec4b15a7e45f8b493fcd4fdda5387f782564ab394989dccbc19c0ccc09aff3004da794399fe7531052961ccff32d264d3c7df6f00b289efb737536ead23e4a13ab25e73accd417bb3455251da97bc4cbc76cc90b93bd3b2ca6e90bbfb8c6cc10f0fb877ba2d9f6cc9632beb95b6eb9bd3df9fea9c03e0811218f7ae", @ANYBLOB="28da9a2f1cc736a94ed3722124928652cfcdc4b1d31fffe1fe385b66843b381d607bec4f5d7439f3b64f1a22e05d762c36a5afc747ef25e42cc4609223e3145a411f6d3f507a11a6f1282f812cdb65764bc076df328eff96a90a8433804e86bd8b60d5f4b191ffa4a895c2f864971a13d3c7133ee5c5778760c4f2581bbd69226435115c8b49848bcbb75a799cbb3023a8de299e6261a55e5fc93b30d1d1c7ade71b663badab4c13b5463b522061d4f2142aeaf17ad66198c8bfe5a23dcf65b0f06e49ccb81643a0822ce8097795a786fd8c02a9f0ee4949d6bdbc8d00a4bf78093a788f870c825ba8bb70ac808295bcff1b58e0be77ce888b504df176d0be5c633907719dba3e670a70abf48878ddc24388307d56d25c9c884b52b917d0c1558393b89bad24614f14ac26eb2608239e39abaa0ba07b740c93411f4a00bf543ae240a40670f1c68bea0f3697efe211ed4e6c63bab529be5f7c9336763bd827646a57003c8c9f5d2c6bd99abdf1e3049a964bd9d5eaf94b22783c2e8302c665d7a74ad3eb9e8f0ca40ddc4a3d73125f6cd47307518dbf68a2850b6ec1abc90189456212695f2bf4364fe65b9d191e525a7c2b6e7280135dbe288e2b91140e067866f16e2a0e7ddee25a3fdd1959267a6d29be4141c8b0ac9ebab51f17bcbb231a65c23d5c2736e6fdddd292ba67542cb7fa60842c231fa94e17c27b3d6c1a81c6c0d9949c7abdecff8eb4b21af1a8a222302b18777150432e1e41c41aa1ac5c7efcf6e7a4292314d750ce9ea394af8c0e11fa5f4855e8f81319833ce2e6b374e4ad486421c6ce1be1d6f66d0ae0b7abf00dc1df8ea274d2489e0207e4a7fc243ac7e89b7f81ebd30d33efb55b09c12bf6312e08d45c8b815c64c6401ff92a006416839a374923ed0271935f0ee078f39b7c57121adac47439696d6e6d20886ca18b41b258cc9f6659cab48c9b9c10404c4abb4244f85fc19d41d319dceb9fdcdebb5220200380b70653eb8690282e21d9407a2f53f086053ea64c97f8d6c349dea23a1acc8b4d3b7756142fbcd3eddecbf98f61a0becd9446c71902648b2f0114d2609c31d870335f9553159c9e410d95f0abcb0f72dc55b4bf7357efe95758939179f7d18db4f0c65a064b3caf49325a0bfe9fd893736dea950d5c9e48532896498a89e655d844a0ce8a2fbd647c6f73ff062923999456a73124e8e3db9e140f2a15327c49e1dcdcb949f7905c84be68c2f766f252de885c5885a9cc2bcb17af8ae9c9b6f9bddb96088bb266281cc83910c08f3bb3bd30804490de5fce35b3d5db215e830ca1505f489f045e4f3175bb0deefc68828bfee3ed012bc874c374aaa44af7cee4558b2d77dc910bbfef3a732994270a1a4fa23042826e88568e06c9241365cee3fd2a121af0890b0a362f1d51aa8ba88cf4efc082c5d5da85d476232e0bf8c0cbb204e42c22b61b83de897e4040d21c45352e5cedc0e52aaba5ba74865ed5d98d51beaff39c8db11563c48251d2bbc0813a53aa7c7a1e08f7d263981c485bc70e79714bbc28c7c3f2750a22f6ceb6ad06ff265c634ac79bd7e642304d94a2a3e08594e45be43ed98c7ec1443a438ca3cc8d0ffb1e7e64983cb803bb5eaa9c901566b6d82bf7283d7cb8d929a9e9321f9ff1d0f519446e99199d01768274e25509cf9e0677b19bbe177926c196bbb000f7dee9ee614f83ac5a746c3ca4a86e7e54569831d2a25c348aa0baa6d8ad1f545a66b1f0f3b7fb8a35bf5351f6c4cb712e075213c4a1904f014a298221362d3f925736937f895ea99377d7ba5f04035748f24eba740f6072eac621c0de7050f0208d4f45b746ffa1bb5fbc45d06061d69cfd3c824773500e59cc7ffaeeb6b2c55f928f65fc8b9463745e4267bc6c9f470ebcb1a9bfab36f1f5d59e5d277de81994a3c03864bf8c53f2f389dc8392ff8e1d395ebbaf79e666dde57c32db18a4157f36395458b3d32830e41152be32141958bd546a026aba13e26f120ebafd822f0383504be687967191a44e23b433cf87f7e3929f804801d2158910017cab987bea6076d02a5f95775d2b8950d6c937f9e2d4bba33859e0e03119dc2e340b9ac05cdcb2f1b77c6e88ffa24f4490a263191136fcb97ca61e24a7fef9631286ff7f2f5e8896a3a2015f85b51f05a47fba39e0e3b67e3284e7aedb0832e4a95b6c85e246d53bbb9fd8d5355f70c50bd63f3546acbac7214951be91f6d2e5d9f86a7c253e2e7e04b6fca79c5f96a30d538495c38aa5aa5686969f9aa47c941148142c3bfe7c346e9485bcc66bf9cd681f3eb4cc9887ec5b1adb10317c72c91d56af45c44b964b7c95a3910c97590391b0f232663de62df1e564e98cf46762257af39553ac67d0e42072b1e645072f5715c490a975cf0d74ad4b88e69bc645f16ae1d6861e3ff6e948e4d9b958b95e961e4e79017f45d2b4693921f51e70c493626d0487f1cfd9219cf21c9934d43bd9d19bb02612b5dde8e0b9ea40d9cbf92dc2c2030be22b15feea3f38c1a8747cd8f4db094ece65ff483f6119d9ac76b6c05480b118cad118ceb63142224745d78d17d9c0db7b78a8dd17d46275f00649722b2a9a9bf79dae7e1dd3877ee447c9aaa56999837751f2209406fef2c6e2b7da3a9317edf91d2434b4302916715fdb9814a05d1f89b8f144cf067082e72cd83eb9105e421cdd3e335abc966fedc142297e2c4b4200cdddbfcca3fd5e8b9147b9437651c5f6a2e2b98649d948ce5c23cec4c102510555267b1b12678785a32ead402f593369ae34cc01003d7c6f774ad7f1f9fe10e4d9ef70d0aec1be368b94763b34ceaf3bd49e858892690606702ff7a77cc5c1db5bd143dbb0d48bac438e385c009f34775e9b647e514a8e8ffc7f2dfd4abae69e81ac5effbd55c1d2aaf0277170c66ac49f905fdeb6be4562fc4d80f84e6286d36d0a72af97625bff767ae228d7369c8d6c30244ca0d304c53496ecd6443cd097b119559c417b857748594faa2599f80c0ef59422f48cb412cb8636947473faa47850a91b620b3249560837049a82a4f5c473911ca43ccff3ad38af7dee570bfce3ff8884194d8d41d39b3a94fb528a707fd294bb743f5cf52e9e9b3ed939dc6aa1f9695025e47ec4636d6ce3f0fc00ce3ac4bb00d8d9d381520c4eebf4fcf1ba56094fa81132baee3895a08736be4aa63056841462ba5817391c44686d9b0c9569c583ea721e5e6d6995a9ea3dd07229ab40f2b58d971a93db9aa4fdedaa150384d348af0737e655d4edea0fd4d1d826956bf443d977ad7a30400f76ea7246af9654fa98ffabdcb52690b0edfdd65355ad8ea764cb3097303a504b7ed9fe49516b5410de36e0acd0bf6259aed94f1efcadaf0494d40224f9f3214e2bb373675e0c5734f63bcd382ac88cdbb7468d3eccbd4707da5e85537820e32011c575fe1c9da18b657f1a2cd63c1f63d917894fa8ab621c5b0b9732d50b7d41a42e7fc9db63a0679bba66053ec909d92e55c732fa8fd5ad997a3b55dda0fb820c400f86b8c07f94c2705ac0005991c55f4a3618cff989640b3f80207c316214ccd279bf1884ef232811c145ea5ff360bbba3292af78224bcdc4baedba91385a6bed8fd6c74f265c041d141cbdc289dad3562014c33851d449ed84a75e9facdee30ee4b6b216053ca20598ad380ea77c43459aad1a4d1cdc8c0206b14de51d382cb3bfb1af26f06a573857dcdbbe73ac4b1e0d75a7edd0d36129c570a94fec60a468c0eea0a80cafc1e996d5ceea1b92bff21d3706ee6b35eab4802f347849852a19cc60abd72ff69e3db985caf2030bf84762036a4dc2ed2b3883df616c28f6a715e82100c200ff5ed6900f7b2f5a27663d268bd8d1f8c25b276e78d1c5e39d4ea2506bab4a38f110a5ac85ace6d7001d8fe5044a2b519c38ff404d6e38080eb4b65633fccf810e7d59ccc2f3186bf70f1f5cea3eeb18ab97676db67488fa3139f4969d33a8e27271b1427e5028fd1b4b68ed5e108c0b2734ddf0966fc91074cfd048db6acc87f9e57ba873e0f3403315a2598ae6089b199f5d5dafe655530fe9df513016dfd1064fab61741ae28f0875fd25e85def18a6f7ee52ebb876627099f63411fa7a3580db990f1b44963afc347540e6830c9c4f88389710050ff9927d3138cdce5be9043596903656c5283682006c210e3a7e93c2cfd5e9bf1a3d82e4f690b36fbf5da0240ce5539ec4c6d7cff734e4cfafc695d461fb8a039c7d86dbdaa484972f05eefe286099415ea09ae4dbe01d29f252134f96f924a68f07e8c5928d01a2ecb6b71b522b168a8e9be2263e05fedf5eebdd19148ba2cd715a0f258ee8384dde52b465fe6dac627e6228870027902c09557becac07201e4cab0a5c5beea51e9020cd988e9ef0ef008e70bf06e818d5f4319239659b24a442070d068e61710ed52bc32b60a3470ed9b50eca1c7100a9392b9fca09981b05523dfaf504d3ed38844b1dc30c0b0fad415036c7ba0af7494c4f7f6d5f416ebbf1751e0a192bf3fd88483f5420e6cf1eac8b3dd717df521aea3775063b47dd1b74fd55ea41b21b48fea4d5cc19abb0a832c789a1f26c38a13f92bfcaea7c8ea38b256a3f90e6d48cdb5f887f6a36c9741e2e3d78f912ab730364f0a27e5894118ae3cbb3b03c8cf558e8f151091bc316aa9bff2f2796f74e64d9e2f09e328d83b28443f80e5f06c0e05e49b4aa2306d12899c04c4c19c10946a1addbd4773e71461bb0cbd86cd3db65fa66219932b307f64dc899416038d16f2c59ccd8dc0c28f80f43261539e5e75702aeec05288f3c0f3a172c62789f5d2781c32a981618d0080bef0361baa5a88bac9c500c87e944036e8862e363e47a43ab7ffbb4a27bd8bdb62006109675c4d04634fa16d22161fb248ac063a312fb98a2e79db2d0cc2571bc751c2847f631ebf1872067b062c0ab7d72520f2a0f0b61a59bc41e0464260ba3617fd50367b3d6bf6d58d906c025dd875ae0807769e1292be8c0167a3bd96db0ab6eb0c6e0065d08998633b5ae5a3ac166cb20d24ac673ecabc027f3dade542c80f5c0db05b6ac05feeed5f2d1524989543a2cf32eb6867532aaaf3526a24eae749bf1d1b1f00f349fd63b6db89c12e0ff8babf695c52e794afc1abed8430ede135b27430224882747abf8ef669bc4da36812c141944d2351cc277a7f500961f5fa5159ac57eafdce7c198457996323193f02bf1e6aefe069849582da635ef0dcbe4518881749a11440e9aa5927c672d7626ef286c69f5637f9a963a766469092a1921d5b2e8265ccd4840fadfa6da8087928e29f02f5c8abb90b983b5b5fda5737725fd6294567e68a8d02eb2a677426b1b89cd4db302562dcd9a47c1b29bfc91730b7374f129688009a6e699e865ab88c34e02e1cb3ed30fd5ce11d1225790aca77e3c1b486a49b8c46cd79b0da6ddce7262f87d45496bcfe86a64965c77b4c9e42001800a150ef49ce179a945d18b276ead9c45b554ffd71e2ed07f4380dd94b0c737ebeeae1fca5317ded582df0d0e3bf11e9267fe6a17e6de8672181f07d345e032d4f9a21ce9c7e67e781e99576babbfd6a40b1f5db8bb38d6b7c0b2e2fc6b5dfecd4ca96428327b0c349d83b8a70d44895af1a0f3de1ceaa7ce8a8caa548c60d50fc46ca34f85c22577869e80358d91c132da69e987665f59cbe8b2ca84e84c33d17bdcf8dbc818a2c8b924860856da0a77a640d67a1d4a4c066f5d98497bb2ff911efa3651439fbba9bdd626bcf4161e6f0d94110533d9730b0ba4da477ced060ed7c9d0fea7b1075da476c9ab5405b7c4a9ee2b8a74e4d1944a5b8ae2a935fecf0b171c5217f67dfad8348da2a2bdee860ad3dc2bba05e6a9b48312fe5edb59dff246f2", @ANYBLOB="4434cdbcc5f4778531d1"], &(0x7f0000003500)={0x0, 0x0, 0x0, 0x0}) executing program 0: syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYRESHEX=0x0, @ANYRESOCT], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NILFS_IOCTL_GET_CPSTAT(r1, 0x80186e83, &(0x7f0000000300)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000002000000600000008000300", @ANYRES32=r3, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040001}, 0x40801) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="5a53fe8e378bea61e8796d39bddde5ee79ed541be00f01305ec9ef082be00b20488edce2c5b4f11dc6f81445e4b349bff8bc6a5cb6cc98280a2844fc072193c4681477d7dda4c7c32f38c922f5d26aebc3aa03a3a69e705ddcad7af27ce8c90fa0f759a4a7c99aabe8b3ae6d0f38bca66b08c1f567ed57dd992c5831ce31186123d77d2a844c9ef3ee20f91b18185aab198fc5f4b40cd74692d0da807f67269bcc2c123e90999ba4f7b1d82c5e91b6061322ca4bbfcbf4ed897c4d972160aa307f8278a788125651cb6c0ee0a2d7fbbb62b6d763a9b5071f9e274e5f6871341123d8e6cdf528f3a762b1e00ac4d7897732f0dc29f4b7d7c041d5b48e4055e11b3d89506c685ac71643432e9dba15727157c3d6a5c2b6aabda6c9f6bb8e0827104d0000000000977b4424641e9c9dcf9d0b298563", @ANYRES16=0x0, @ANYRES64=r2, @ANYRES32=r3, @ANYBLOB="0c00118004000600040006000c00bd00ff7f0600010009000a00060008021100000000000600ed00a2020000280011800400070004000200040002000400010004000300040003000400010004000300040003000500c200090000000a0006000802110000000000"], 0x84}}, 0x800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x537d2ba428f33b01) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYRESDEC=r1], 0x18}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0xc0109428, &(0x7f0000000100)={0x1, 0x5c410c3c}) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x6d) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc0000000000000000000000000000000a01010000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x40004) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x2520, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340), 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000240)="db2d82e6036cbb7e31105314a0fe5f5989bce02d44c1641ffc1cd7d99f6d010251ce2340064f5cac4f96a73d6983035797d24dd1d5f72084b2979a327b1631b445d3ca60d4a2d216cf6a20bf4c449b790b1cea906d2c8203173bb46f2d23ee787772e35c17223f0f1dfc8faab1a7e7d53b3f1839a3f9ec10e980f3c0e89e808b4641aacc977b69172e7ae9efb164c872a29124d879022a25237a", 0x9a}, {&(0x7f00000005c0)="6c43a715ebbd318addcd79db30fc82c7897cc1af4d30ef0c0793f7", 0x1b}], 0x2}}], 0x1, 0x24040015) r6 = socket(0x28, 0x801, 0x0) shutdown(r6, 0x3) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) readv(r0, 0x0, 0x0) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) getpgrp(0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x0, 0xc0107520, 0x20}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000b00)) executing program 2: mkdir(&(0x7f0000000000)='./file0/../file0\x00', 0xa383bdae8a56c7c6) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r0) tkill(r0, 0x12) ptrace(0x4208, r0) tkill(r0, 0x12) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xe01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x3) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x400005, 0xd, 0x100000001, 0x646, 0x80000001ffffc, 0x5, 0x7, 0x8, 0x8, 0x8, 0x3, 0x7ff, 0x4, 0x3, 0x7f, 0xc], 0x4000, 0x101}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d00, 0x0, 0x8}]}) mount$overlay(0x0, &(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080), 0x3201481, &(0x7f0000000540)={[{@redirect_dir_off}]}) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r3, 0x1, 0x74bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x26000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x800) (async, rerun: 64) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r3, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x1}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044880}, 0x1) (rerun: 64) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x29, 0xff, 0x5, 0x2, 0x21, @empty, @empty, 0x8000, 0x1, 0x100, 0x7}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) executing program 1: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) (async) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000001140), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) (async) fcntl$addseals(r5, 0x409, 0x7) (async) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x1000, 0x1000}) ioctl$DMA_BUF_SET_NAME_A(r6, 0x40086201, &(0x7f0000000040)='\\\'.:\x00') syz_usb_connect$uac2(0x3, 0x90, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000300000010b4041c9340000102030109027e000301048009080b00010100200009040000000101200009240108000a1e000809240d0601000203000c2403030001e002020600050904010000010220000904010101010220000905010920000a0306082501013c810e0009040200000102200009040101"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) (async) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) executing program 3: r0 = socket$inet(0x2, 0x3, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10) write$tun(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000440)=""/212, 0xd4, 0x2, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800900, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000080)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000900), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r6, @ANYRES8=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f, 0xe0000000, 0x564b043a, 0x83, 0xffff, 0x5, 0x2, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) syz_fuse_handle_req(r6, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x121d01, 0x82) dup3(r8, r6, 0x6700000000000000) ioctl$FS_IOC_FSGETXATTR(r8, 0x801c581f, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000040)="9a020000007b000f20c035000000400f22c0c4c3f95c8853b5d9b0000f79dbb9800000c00f3235000100000f30f30fbc3bc4e299b72c200f21e266baf80cb8be3d8d83ef66bafc0c66edc4e2b9dc10", 0x4f}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r5, 0x8010aebc, &(0x7f0000000300)={0x6000, 0x100000}) executing program 0: setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0x2cbdda69, 0xc}]}, 0xc, 0x2) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) writev(r0, &(0x7f00000004c0), 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000040)={0x0, 0x2008000}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0xc0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000300)=@gcm_128={{0x304}, "793ba630b2de12f8", "c638280e9b39583cc7fd269640bc0334", "36ebbafd", "cf5506fd54cac505"}, 0x28) write$binfmt_script(r3, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x1007}]}) timer_create(0x2, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$inet6(r2, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffc, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000700)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x2}}}, @dstopts_2292={{0x18, 0x29, 0x3b}}, @hoplimit={{0x14, 0x29, 0x34, 0x9}}], 0x48}, 0x0) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 32: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 1: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, 0x0, 0x0) sendmsg$tipc(r0, 0x0, 0x20008081) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r7, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="51b0250c0000000800030000000000000000", @ANYRES32=r9, @ANYBLOB="0c009900faffffff6b0000000a000600ffffffffffff0000200050800800070003000000090001007fe022d63c000000080007000100000004002800"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x8000) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: bisecting 25 programs bisect: split chunks (needed=false): <25> bisect: split chunk #0 of len 25 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 8, 15, 16, 30, 6, 14, 18, 14, 25, 4, 15, 7, 7, 13] detailed listing: executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x72, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040010}, 0x80) (async) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x40001, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, &(0x7f00000000c0)=0x104, 0x4) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001"], 0xfdef) (async) r11 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r12 = dup(r11) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = dup(r6) ioctl$PTP_EXTTS_REQUEST2(r14, 0xc0603d06, &(0x7f0000000040)={0x200}) (async) ptrace(0x8, r0) syz_usb_connect$midi(0x3, 0x59, &(0x7f0000001f80)=ANY=[@ANYRES8=r1, @ANYBLOB="343fc0c99291f0869161e84d8093cf44530b4466b27115d9e455c1eda5a374dc44401c030880c1771d33b6e8aa0778cdd2f8fcf7965b1a32f22fb2438d72dec4b15a7e45f8b493fcd4fdda5387f782564ab394989dccbc19c0ccc09aff3004da794399fe7531052961ccff32d264d3c7df6f00b289efb737536ead23e4a13ab25e73accd417bb3455251da97bc4cbc76cc90b93bd3b2ca6e90bbfb8c6cc10f0fb877ba2d9f6cc9632beb95b6eb9bd3df9fea9c03e0811218f7ae", @ANYBLOB="28da9a2f1cc736a94ed3722124928652cfcdc4b1d31fffe1fe385b66843b381d607bec4f5d7439f3b64f1a22e05d762c36a5afc747ef25e42cc4609223e3145a411f6d3f507a11a6f1282f812cdb65764bc076df328eff96a90a8433804e86bd8b60d5f4b191ffa4a895c2f864971a13d3c7133ee5c5778760c4f2581bbd69226435115c8b49848bcbb75a799cbb3023a8de299e6261a55e5fc93b30d1d1c7ade71b663badab4c13b5463b522061d4f2142aeaf17ad66198c8bfe5a23dcf65b0f06e49ccb81643a0822ce8097795a786fd8c02a9f0ee4949d6bdbc8d00a4bf78093a788f870c825ba8bb70ac808295bcff1b58e0be77ce888b504df176d0be5c633907719dba3e670a70abf48878ddc24388307d56d25c9c884b52b917d0c1558393b89bad24614f14ac26eb2608239e39abaa0ba07b740c93411f4a00bf543ae240a40670f1c68bea0f3697efe211ed4e6c63bab529be5f7c9336763bd827646a57003c8c9f5d2c6bd99abdf1e3049a964bd9d5eaf94b22783c2e8302c665d7a74ad3eb9e8f0ca40ddc4a3d73125f6cd47307518dbf68a2850b6ec1abc90189456212695f2bf4364fe65b9d191e525a7c2b6e7280135dbe288e2b91140e067866f16e2a0e7ddee25a3fdd1959267a6d29be4141c8b0ac9ebab51f17bcbb231a65c23d5c2736e6fdddd292ba67542cb7fa60842c231fa94e17c27b3d6c1a81c6c0d9949c7abdecff8eb4b21af1a8a222302b18777150432e1e41c41aa1ac5c7efcf6e7a4292314d750ce9ea394af8c0e11fa5f4855e8f81319833ce2e6b374e4ad486421c6ce1be1d6f66d0ae0b7abf00dc1df8ea274d2489e0207e4a7fc243ac7e89b7f81ebd30d33efb55b09c12bf6312e08d45c8b815c64c6401ff92a006416839a374923ed0271935f0ee078f39b7c57121adac47439696d6e6d20886ca18b41b258cc9f6659cab48c9b9c10404c4abb4244f85fc19d41d319dceb9fdcdebb5220200380b70653eb8690282e21d9407a2f53f086053ea64c97f8d6c349dea23a1acc8b4d3b7756142fbcd3eddecbf98f61a0becd9446c71902648b2f0114d2609c31d870335f9553159c9e410d95f0abcb0f72dc55b4bf7357efe95758939179f7d18db4f0c65a064b3caf49325a0bfe9fd893736dea950d5c9e48532896498a89e655d844a0ce8a2fbd647c6f73ff062923999456a73124e8e3db9e140f2a15327c49e1dcdcb949f7905c84be68c2f766f252de885c5885a9cc2bcb17af8ae9c9b6f9bddb96088bb266281cc83910c08f3bb3bd30804490de5fce35b3d5db215e830ca1505f489f045e4f3175bb0deefc68828bfee3ed012bc874c374aaa44af7cee4558b2d77dc910bbfef3a732994270a1a4fa23042826e88568e06c9241365cee3fd2a121af0890b0a362f1d51aa8ba88cf4efc082c5d5da85d476232e0bf8c0cbb204e42c22b61b83de897e4040d21c45352e5cedc0e52aaba5ba74865ed5d98d51beaff39c8db11563c48251d2bbc0813a53aa7c7a1e08f7d263981c485bc70e79714bbc28c7c3f2750a22f6ceb6ad06ff265c634ac79bd7e642304d94a2a3e08594e45be43ed98c7ec1443a438ca3cc8d0ffb1e7e64983cb803bb5eaa9c901566b6d82bf7283d7cb8d929a9e9321f9ff1d0f519446e99199d01768274e25509cf9e0677b19bbe177926c196bbb000f7dee9ee614f83ac5a746c3ca4a86e7e54569831d2a25c348aa0baa6d8ad1f545a66b1f0f3b7fb8a35bf5351f6c4cb712e075213c4a1904f014a298221362d3f925736937f895ea99377d7ba5f04035748f24eba740f6072eac621c0de7050f0208d4f45b746ffa1bb5fbc45d06061d69cfd3c824773500e59cc7ffaeeb6b2c55f928f65fc8b9463745e4267bc6c9f470ebcb1a9bfab36f1f5d59e5d277de81994a3c03864bf8c53f2f389dc8392ff8e1d395ebbaf79e666dde57c32db18a4157f36395458b3d32830e41152be32141958bd546a026aba13e26f120ebafd822f0383504be687967191a44e23b433cf87f7e3929f804801d2158910017cab987bea6076d02a5f95775d2b8950d6c937f9e2d4bba33859e0e03119dc2e340b9ac05cdcb2f1b77c6e88ffa24f4490a263191136fcb97ca61e24a7fef9631286ff7f2f5e8896a3a2015f85b51f05a47fba39e0e3b67e3284e7aedb0832e4a95b6c85e246d53bbb9fd8d5355f70c50bd63f3546acbac7214951be91f6d2e5d9f86a7c253e2e7e04b6fca79c5f96a30d538495c38aa5aa5686969f9aa47c941148142c3bfe7c346e9485bcc66bf9cd681f3eb4cc9887ec5b1adb10317c72c91d56af45c44b964b7c95a3910c97590391b0f232663de62df1e564e98cf46762257af39553ac67d0e42072b1e645072f5715c490a975cf0d74ad4b88e69bc645f16ae1d6861e3ff6e948e4d9b958b95e961e4e79017f45d2b4693921f51e70c493626d0487f1cfd9219cf21c9934d43bd9d19bb02612b5dde8e0b9ea40d9cbf92dc2c2030be22b15feea3f38c1a8747cd8f4db094ece65ff483f6119d9ac76b6c05480b118cad118ceb63142224745d78d17d9c0db7b78a8dd17d46275f00649722b2a9a9bf79dae7e1dd3877ee447c9aaa56999837751f2209406fef2c6e2b7da3a9317edf91d2434b4302916715fdb9814a05d1f89b8f144cf067082e72cd83eb9105e421cdd3e335abc966fedc142297e2c4b4200cdddbfcca3fd5e8b9147b9437651c5f6a2e2b98649d948ce5c23cec4c102510555267b1b12678785a32ead402f593369ae34cc01003d7c6f774ad7f1f9fe10e4d9ef70d0aec1be368b94763b34ceaf3bd49e858892690606702ff7a77cc5c1db5bd143dbb0d48bac438e385c009f34775e9b647e514a8e8ffc7f2dfd4abae69e81ac5effbd55c1d2aaf0277170c66ac49f905fdeb6be4562fc4d80f84e6286d36d0a72af97625bff767ae228d7369c8d6c30244ca0d304c53496ecd6443cd097b119559c417b857748594faa2599f80c0ef59422f48cb412cb8636947473faa47850a91b620b3249560837049a82a4f5c473911ca43ccff3ad38af7dee570bfce3ff8884194d8d41d39b3a94fb528a707fd294bb743f5cf52e9e9b3ed939dc6aa1f9695025e47ec4636d6ce3f0fc00ce3ac4bb00d8d9d381520c4eebf4fcf1ba56094fa81132baee3895a08736be4aa63056841462ba5817391c44686d9b0c9569c583ea721e5e6d6995a9ea3dd07229ab40f2b58d971a93db9aa4fdedaa150384d348af0737e655d4edea0fd4d1d826956bf443d977ad7a30400f76ea7246af9654fa98ffabdcb52690b0edfdd65355ad8ea764cb3097303a504b7ed9fe49516b5410de36e0acd0bf6259aed94f1efcadaf0494d40224f9f3214e2bb373675e0c5734f63bcd382ac88cdbb7468d3eccbd4707da5e85537820e32011c575fe1c9da18b657f1a2cd63c1f63d917894fa8ab621c5b0b9732d50b7d41a42e7fc9db63a0679bba66053ec909d92e55c732fa8fd5ad997a3b55dda0fb820c400f86b8c07f94c2705ac0005991c55f4a3618cff989640b3f80207c316214ccd279bf1884ef232811c145ea5ff360bbba3292af78224bcdc4baedba91385a6bed8fd6c74f265c041d141cbdc289dad3562014c33851d449ed84a75e9facdee30ee4b6b216053ca20598ad380ea77c43459aad1a4d1cdc8c0206b14de51d382cb3bfb1af26f06a573857dcdbbe73ac4b1e0d75a7edd0d36129c570a94fec60a468c0eea0a80cafc1e996d5ceea1b92bff21d3706ee6b35eab4802f347849852a19cc60abd72ff69e3db985caf2030bf84762036a4dc2ed2b3883df616c28f6a715e82100c200ff5ed6900f7b2f5a27663d268bd8d1f8c25b276e78d1c5e39d4ea2506bab4a38f110a5ac85ace6d7001d8fe5044a2b519c38ff404d6e38080eb4b65633fccf810e7d59ccc2f3186bf70f1f5cea3eeb18ab97676db67488fa3139f4969d33a8e27271b1427e5028fd1b4b68ed5e108c0b2734ddf0966fc91074cfd048db6acc87f9e57ba873e0f3403315a2598ae6089b199f5d5dafe655530fe9df513016dfd1064fab61741ae28f0875fd25e85def18a6f7ee52ebb876627099f63411fa7a3580db990f1b44963afc347540e6830c9c4f88389710050ff9927d3138cdce5be9043596903656c5283682006c210e3a7e93c2cfd5e9bf1a3d82e4f690b36fbf5da0240ce5539ec4c6d7cff734e4cfafc695d461fb8a039c7d86dbdaa484972f05eefe286099415ea09ae4dbe01d29f252134f96f924a68f07e8c5928d01a2ecb6b71b522b168a8e9be2263e05fedf5eebdd19148ba2cd715a0f258ee8384dde52b465fe6dac627e6228870027902c09557becac07201e4cab0a5c5beea51e9020cd988e9ef0ef008e70bf06e818d5f4319239659b24a442070d068e61710ed52bc32b60a3470ed9b50eca1c7100a9392b9fca09981b05523dfaf504d3ed38844b1dc30c0b0fad415036c7ba0af7494c4f7f6d5f416ebbf1751e0a192bf3fd88483f5420e6cf1eac8b3dd717df521aea3775063b47dd1b74fd55ea41b21b48fea4d5cc19abb0a832c789a1f26c38a13f92bfcaea7c8ea38b256a3f90e6d48cdb5f887f6a36c9741e2e3d78f912ab730364f0a27e5894118ae3cbb3b03c8cf558e8f151091bc316aa9bff2f2796f74e64d9e2f09e328d83b28443f80e5f06c0e05e49b4aa2306d12899c04c4c19c10946a1addbd4773e71461bb0cbd86cd3db65fa66219932b307f64dc899416038d16f2c59ccd8dc0c28f80f43261539e5e75702aeec05288f3c0f3a172c62789f5d2781c32a981618d0080bef0361baa5a88bac9c500c87e944036e8862e363e47a43ab7ffbb4a27bd8bdb62006109675c4d04634fa16d22161fb248ac063a312fb98a2e79db2d0cc2571bc751c2847f631ebf1872067b062c0ab7d72520f2a0f0b61a59bc41e0464260ba3617fd50367b3d6bf6d58d906c025dd875ae0807769e1292be8c0167a3bd96db0ab6eb0c6e0065d08998633b5ae5a3ac166cb20d24ac673ecabc027f3dade542c80f5c0db05b6ac05feeed5f2d1524989543a2cf32eb6867532aaaf3526a24eae749bf1d1b1f00f349fd63b6db89c12e0ff8babf695c52e794afc1abed8430ede135b27430224882747abf8ef669bc4da36812c141944d2351cc277a7f500961f5fa5159ac57eafdce7c198457996323193f02bf1e6aefe069849582da635ef0dcbe4518881749a11440e9aa5927c672d7626ef286c69f5637f9a963a766469092a1921d5b2e8265ccd4840fadfa6da8087928e29f02f5c8abb90b983b5b5fda5737725fd6294567e68a8d02eb2a677426b1b89cd4db302562dcd9a47c1b29bfc91730b7374f129688009a6e699e865ab88c34e02e1cb3ed30fd5ce11d1225790aca77e3c1b486a49b8c46cd79b0da6ddce7262f87d45496bcfe86a64965c77b4c9e42001800a150ef49ce179a945d18b276ead9c45b554ffd71e2ed07f4380dd94b0c737ebeeae1fca5317ded582df0d0e3bf11e9267fe6a17e6de8672181f07d345e032d4f9a21ce9c7e67e781e99576babbfd6a40b1f5db8bb38d6b7c0b2e2fc6b5dfecd4ca96428327b0c349d83b8a70d44895af1a0f3de1ceaa7ce8a8caa548c60d50fc46ca34f85c22577869e80358d91c132da69e987665f59cbe8b2ca84e84c33d17bdcf8dbc818a2c8b924860856da0a77a640d67a1d4a4c066f5d98497bb2ff911efa3651439fbba9bdd626bcf4161e6f0d94110533d9730b0ba4da477ced060ed7c9d0fea7b1075da476c9ab5405b7c4a9ee2b8a74e4d1944a5b8ae2a935fecf0b171c5217f67dfad8348da2a2bdee860ad3dc2bba05e6a9b48312fe5edb59dff246f2", @ANYBLOB="4434cdbcc5f4778531d1"], &(0x7f0000003500)={0x0, 0x0, 0x0, 0x0}) executing program 0: syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYRESHEX=0x0, @ANYRESOCT], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NILFS_IOCTL_GET_CPSTAT(r1, 0x80186e83, &(0x7f0000000300)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000002000000600000008000300", @ANYRES32=r3, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040001}, 0x40801) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="5a53fe8e378bea61e8796d39bddde5ee79ed541be00f01305ec9ef082be00b20488edce2c5b4f11dc6f81445e4b349bff8bc6a5cb6cc98280a2844fc072193c4681477d7dda4c7c32f38c922f5d26aebc3aa03a3a69e705ddcad7af27ce8c90fa0f759a4a7c99aabe8b3ae6d0f38bca66b08c1f567ed57dd992c5831ce31186123d77d2a844c9ef3ee20f91b18185aab198fc5f4b40cd74692d0da807f67269bcc2c123e90999ba4f7b1d82c5e91b6061322ca4bbfcbf4ed897c4d972160aa307f8278a788125651cb6c0ee0a2d7fbbb62b6d763a9b5071f9e274e5f6871341123d8e6cdf528f3a762b1e00ac4d7897732f0dc29f4b7d7c041d5b48e4055e11b3d89506c685ac71643432e9dba15727157c3d6a5c2b6aabda6c9f6bb8e0827104d0000000000977b4424641e9c9dcf9d0b298563", @ANYRES16=0x0, @ANYRES64=r2, @ANYRES32=r3, @ANYBLOB="0c00118004000600040006000c00bd00ff7f0600010009000a00060008021100000000000600ed00a2020000280011800400070004000200040002000400010004000300040003000400010004000300040003000500c200090000000a0006000802110000000000"], 0x84}}, 0x800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x537d2ba428f33b01) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYRESDEC=r1], 0x18}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0xc0109428, &(0x7f0000000100)={0x1, 0x5c410c3c}) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x6d) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc0000000000000000000000000000000a01010000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x40004) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x2520, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340), 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000240)="db2d82e6036cbb7e31105314a0fe5f5989bce02d44c1641ffc1cd7d99f6d010251ce2340064f5cac4f96a73d6983035797d24dd1d5f72084b2979a327b1631b445d3ca60d4a2d216cf6a20bf4c449b790b1cea906d2c8203173bb46f2d23ee787772e35c17223f0f1dfc8faab1a7e7d53b3f1839a3f9ec10e980f3c0e89e808b4641aacc977b69172e7ae9efb164c872a29124d879022a25237a", 0x9a}, {&(0x7f00000005c0)="6c43a715ebbd318addcd79db30fc82c7897cc1af4d30ef0c0793f7", 0x1b}], 0x2}}], 0x1, 0x24040015) r6 = socket(0x28, 0x801, 0x0) shutdown(r6, 0x3) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) readv(r0, 0x0, 0x0) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) getpgrp(0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x0, 0xc0107520, 0x20}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000b00)) executing program 2: mkdir(&(0x7f0000000000)='./file0/../file0\x00', 0xa383bdae8a56c7c6) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r0) tkill(r0, 0x12) ptrace(0x4208, r0) tkill(r0, 0x12) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xe01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x3) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x400005, 0xd, 0x100000001, 0x646, 0x80000001ffffc, 0x5, 0x7, 0x8, 0x8, 0x8, 0x3, 0x7ff, 0x4, 0x3, 0x7f, 0xc], 0x4000, 0x101}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d00, 0x0, 0x8}]}) mount$overlay(0x0, &(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080), 0x3201481, &(0x7f0000000540)={[{@redirect_dir_off}]}) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r3, 0x1, 0x74bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x26000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x800) (async, rerun: 64) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r3, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x1}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044880}, 0x1) (rerun: 64) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x29, 0xff, 0x5, 0x2, 0x21, @empty, @empty, 0x8000, 0x1, 0x100, 0x7}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) executing program 1: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) (async) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000001140), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) (async) fcntl$addseals(r5, 0x409, 0x7) (async) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x1000, 0x1000}) ioctl$DMA_BUF_SET_NAME_A(r6, 0x40086201, &(0x7f0000000040)='\\\'.:\x00') syz_usb_connect$uac2(0x3, 0x90, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000300000010b4041c9340000102030109027e000301048009080b00010100200009040000000101200009240108000a1e000809240d0601000203000c2403030001e002020600050904010000010220000904010101010220000905010920000a0306082501013c810e0009040200000102200009040101"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) (async) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) executing program 3: r0 = socket$inet(0x2, 0x3, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10) write$tun(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000440)=""/212, 0xd4, 0x2, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800900, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000080)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000900), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r6, @ANYRES8=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f, 0xe0000000, 0x564b043a, 0x83, 0xffff, 0x5, 0x2, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) syz_fuse_handle_req(r6, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x121d01, 0x82) dup3(r8, r6, 0x6700000000000000) ioctl$FS_IOC_FSGETXATTR(r8, 0x801c581f, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000040)="9a020000007b000f20c035000000400f22c0c4c3f95c8853b5d9b0000f79dbb9800000c00f3235000100000f30f30fbc3bc4e299b72c200f21e266baf80cb8be3d8d83ef66bafc0c66edc4e2b9dc10", 0x4f}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r5, 0x8010aebc, &(0x7f0000000300)={0x6000, 0x100000}) executing program 0: setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0x2cbdda69, 0xc}]}, 0xc, 0x2) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) writev(r0, &(0x7f00000004c0), 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000040)={0x0, 0x2008000}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0xc0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000300)=@gcm_128={{0x304}, "793ba630b2de12f8", "c638280e9b39583cc7fd269640bc0334", "36ebbafd", "cf5506fd54cac505"}, 0x28) write$binfmt_script(r3, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x1007}]}) timer_create(0x2, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$inet6(r2, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffc, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000700)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x2}}}, @dstopts_2292={{0x18, 0x29, 0x3b}}, @hoplimit={{0x14, 0x29, 0x34, 0x9}}], 0x48}, 0x0) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 32: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 1: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, 0x0, 0x0) sendmsg$tipc(r0, 0x0, 0x20008081) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r7, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="51b0250c0000000800030000000000000000", @ANYRES32=r9, @ANYBLOB="0c009900faffffff6b0000000a000600ffffffffffff0000200050800800070003000000090001007fe022d63c000000080007000100000004002800"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x8000) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30, 4, 10, 33, 19, 10, 14, 16, 14, 25, 4, 15, 7, 7, 13] detailed listing: executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0xa400, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000140)={0x600000000000000, 0x40000, 0x0, 0x8, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0x11, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r4, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000001980)=[{0x0, 0xdd12}], 0x1}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0xdddd1000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0x10000, 0x9, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0x0, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x8000000, 0x0, 0x0, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffffffffe, 0xd801, 0x0, [0x0, 0x0, 0x1]}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x7, 0xfe, 0xe1, 0x0, 0x6, 0xd9, 0x40, 0x1, 0xfb, 0x8, 0xc, 0x0, 0x0, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x0, 0x20, 0x3, 0x0, 0x106c, 0x80000001, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x0, 0x8001], 0x1, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x0, @private=0xa010100, 0x4e24, 0x0, 'lblc\x00', 0x10, 0x8d, 0x1d}, 0x2c) ioctl$EXT4_IOC_GETSTATE(0xffffffffffffffff, 0x40046629, &(0x7f0000000040)) (async) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000080)=[@nested_vmlaunch={0x12f, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0xb64}}, @nested_amd_clgi={0x17f, 0x10}, @nested_load_syzos={0x136, 0xb4, {0x3, 0x5, [@nested_load_code={0x12e, 0x5c, {0x3, "f30fc772b0f3ae66b876000f00d0c461a5e170060f79445c0eb9cc020000b8ce000000ba000000000f30f20fd05fdd420f78ad4f470000c48175fe631326660ff37c8406"}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x537, 0x5, 0x1fb3, 0x7fffffff}}]}}, @nested_amd_stgi={0x17e, 0x10}, @nested_create_vm={0x12d, 0x18}], 0x11c}) ioctl$KVM_CAP_HYPERV_SYNIC2(r0, 0x4068aea3, &(0x7f0000000200)) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000280)=0xf9) (async) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r0, 0x4068aea3, &(0x7f00000002c0)) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000340), 0x2, 0x111040) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000380)={0x37e3, 0x13, [{0xa, 0x1}, {0xa, 0x1}, {0x8}, {0x7}, {0x1}, {0xa}, {0x5, 0x1}, {0xe, 0x1}, {0xb, 0x1}, {}, {0xd}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x8, 0x1}, {0x1, 0x1}, {0xe, 0x1}, {0x3}, {0x2, 0x1}]}) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET_FEATURE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x3fa, 0x400, 0x70bd25, 0x25dfdbff, {0x1, 0x1, 0x1, 0x1}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x80) mmap$usbfs(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x30, r1, 0x5f89) (async) mmap$usbfs(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000000, 0x31, r1, 0x71) (async) r3 = memfd_secret(0x0) ioctl$KVM_NMI(r3, 0xae9a) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500), r3) sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8806}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xc4, r4, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff71}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfff8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5ad}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5f5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffc0}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20008051}, 0x800) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wpan3\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) (rerun: 32) sendmsg$NL802154_CMD_NEW_SEC_DEV(r5, &(0x7f0000000900)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0x90, r6, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVICE={0xc, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0xb}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_DEVICE={0x40, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6}, @NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0x2}, @NL802154_DEV_ATTR_PAN_ID={0x6}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xffff}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x80) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000980), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x20, r10, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x66}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x44090) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000b80)={&(0x7f0000000b40)=[{&(0x7f0000000a80)="3bdcf97de6d0666e9a51108bdd7bd3bf655616719623717edae1be4a82678cf2a9e3087b18c297a87a993995b4f192f0e79d3eff6d9a0f75806ba8f98b8bf4bf32b1ed61", 0x44}, {&(0x7f0000000b00)="446c6d3a86e0a2fdbd7b6c6c71e449fb97ebd746418db4", 0x17}], 0x2, 0x8, 0x0, 0x8697, 0x5b32, 0x2, 0x3, 0xf}) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000c00)) (async, rerun: 64) r11 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000fc0)={0x0, &(0x7f0000000c40)=[@uexit={0x0, 0x18, 0xc24f}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x4fe, 0x5, 0xd8, 0x4}}, @cpuid={0x64, 0x18, {0x4, 0x10000}}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xa6, 0x6, 0x7, 0x1}}, @cpuid={0x64, 0x18, {0x5, 0x7}}, @wr_drn={0x68, 0x20, {0x6, 0x6}}, @rdmsr={0x66, 0x18, {0x22e}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0xcd17}, @nested_vmresume={0x130, 0x18, 0x1}, @wr_drn={0x68, 0x20, {0x7, 0x7}}, @wrmsr={0x65, 0x20, {0xa3f, 0x8000000000000000}}, @code={0xa, 0x50, {"b9800000c00f3235010000000f30660f3880410cf3420f01798d440f01cb0f9683530000002e2e66430f62ef660faef30f20c035200000000f22c067a70f08"}}, @cpuid={0x64, 0x18, {0x3, 0x4}}, @out_dx={0x6a, 0x28, {0x463d, 0x6, 0x2}}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_load_code={0x12e, 0x6b, {0x1, "0f20e035000002000f22e0450f783066bad104ecb805000000b9070000000f01c166b80c010f00d866baf80cb8a065198eef66bafc0c66ed650fc7b806880000263e420f01c2f30f2ac4c4c13575bd1f626c99"}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xb05a, 0x7ff, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x482, 0x8, 0xfffffffffffffff9, 0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x808, 0x9, 0x9, 0x2c32}}], 0x36b}) (rerun: 64) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000001040)=@arm64_sve={0x6080000000150488, &(0x7f0000001000)=0x1}) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4001af83, 0x0) syz_usb_connect$uac1(0x3, 0x87, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000002082050c004000010203010902750003010600950904000000010100000a2401d4000a00020102090401000001020000090401010101020000072401f5f900000e2402030604b1020c47148017f309050109100007010c07250104070400090402000001029f89c965ea4570000009040201010102"], 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000180)={@initdev, @dev}, &(0x7f0000000280)=0xc) (rerun: 32) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) (async) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x64, r4, 0x4, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x1, 0x34}}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x100}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x18, 0x2d, 0x0, 0x1, [{0x14, 0x0, @random="32a910e3c2ed2d0038d7e9a178734127"}]}, @NL80211_ATTR_SCAN_SSIDS={0x1c, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0xff000000}]}, 0x64}, 0x1, 0x0, 0x0, 0x811}, 0x8001) (async) recvfrom$inet(r2, 0x0, 0x0, 0x1, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="20000080", @ANYRES16=r1, @ANYBLOB="21032bbd7000fcdbdf25040000000c0001800800030003000000"], 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) setgroups(0x0, 0x0) (async) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000080)=[0xee00]) setregid(r3, r3) (async) setregid(r3, r3) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff}) fchdir(r5) (async) fchdir(r5) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) (async) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) r6 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f00009ef000/0x400000)=nil) setuid(0xee00) syz_kvm_add_vcpu$x86(r6, &(0x7f0000000180)={0x0, 0x0}) getpgrp(0x0) (async) r7 = getpgrp(0x0) syz_pidfd_open(r7, 0x0) (async) syz_pidfd_open(r7, 0x0) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') (async) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') clock_gettime(0x0, &(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000580)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000008440)=[{{&(0x7f0000000040)=@nfc_llcp, 0x80, &(0x7f0000000880)=[{&(0x7f00000001c0)=""/216, 0xd8}, {&(0x7f00000002c0)=""/46, 0x2e}, {&(0x7f0000000300)=""/202, 0xca}, {&(0x7f00000005c0)=""/166, 0xa6}, {&(0x7f0000000680)=""/242, 0xf2}, {&(0x7f0000000780)=""/133, 0x85}, {&(0x7f0000000840)=""/54, 0x36}], 0x7}, 0x1ff}, {{&(0x7f0000000900)=@alg, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000980)}, {&(0x7f00000009c0)=""/207, 0xcf}, {&(0x7f0000000ac0)=""/154, 0x9a}], 0x3, &(0x7f0000000440)=""/204, 0xcc}, 0x7ff}, {{&(0x7f0000000cc0)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000000d40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/114, 0x72}, {&(0x7f0000001dc0)=""/75, 0x4b}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/221, 0xdd}], 0x5, &(0x7f0000002fc0)=""/112, 0x70}, 0x7}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f0000003040)=""/162, 0xa2}, {&(0x7f0000003100)=""/106, 0x6a}, {&(0x7f0000003180)=""/9, 0x9}, {&(0x7f00000031c0)=""/4096, 0x1000}, {&(0x7f00000041c0)=""/233, 0xe9}, {&(0x7f00000042c0)=""/224, 0xe0}, {&(0x7f00000043c0), 0x33}, {&(0x7f0000000bc0)=""/21, 0xf}, {&(0x7f0000004440)=""/238, 0xee}], 0x9, &(0x7f0000004600)=""/39, 0x27}, 0x7}, {{&(0x7f0000004640)=@xdp, 0x80, &(0x7f0000004840)=[{&(0x7f00000046c0)=""/166, 0xa6}, {&(0x7f0000004780)=""/151, 0x97}], 0x2, &(0x7f0000004880)=""/209, 0xd1}, 0x9}, {{&(0x7f0000004980)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000004a00)=""/176, 0xb0}, {&(0x7f0000004ac0)=""/221, 0xdd}, {&(0x7f0000004bc0)=""/222, 0xde}, {&(0x7f0000004cc0)=""/120, 0x78}, {&(0x7f0000004d40)=""/99, 0x63}], 0x5}, 0xfffffc00}, {{&(0x7f0000004e40)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000004ec0)=""/4096, 0x1000}, {&(0x7f0000005ec0)=""/4096, 0x1000}], 0x2, &(0x7f0000006f00)=""/189, 0xbd}, 0x401}, {{0x0, 0x0, &(0x7f0000008180)=[{&(0x7f0000006fc0)=""/25, 0x19}, {&(0x7f0000007000)=""/110, 0x6e}, {&(0x7f0000007080)=""/4096, 0x1000}, {&(0x7f0000000980)=""/33, 0xfffffffffffffcd3}, {&(0x7f00000080c0)=""/178, 0xb2}], 0x5, &(0x7f0000008200)=""/127, 0x7f}, 0xffffff99}, {{&(0x7f0000008280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000083c0)=[{&(0x7f0000008300)=""/126, 0x7e}, {&(0x7f0000008380)=""/27, 0x1b}], 0x2, &(0x7f0000008400)=""/42, 0x2a}, 0x20}], 0x9, 0x100, &(0x7f0000008680)={r8, r9+60000000}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000086c0)=ANY=[@ANYBLOB="54010000100033060000000000000000fe8000000000000000000000000000aaffffffff000000000000000000000000000040000000800400000000870000008792b3fb71e9dd6682007a6eeb5d6bb0a11c0d730b1d923544e3fb58896bd9f30f6c444052475643042c9ea65f771e6c612d29f254a677a996b9c30cfa10", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14143f0000000000000000000000000000000032000000fe80000000000000000000000000003f2703000000000000090008000000000000000000000000000400000000000000ff0f00000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008f000000000000000800000029bd70000000000002000100000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040002005e2100000000ac14143f00"/268], 0x154}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000008d00)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000008cc0)={&(0x7f0000008880)=ANY=[@ANYBLOB="140400004100000425bd7000fddbdf250f000000080098800400d7800c001900070000000000000041000980f99cfbfeb22d74ebf640d9fb411027a99daff104007380267b80c40b0edfe486cc0c00190004000000000000000c005500000000000000e7680400588000000008004d800400398019022e80a0005000d137aeba257b37999d81b545df8765d2cee0d5ac19139ef99a9d80e95d44f66d1572cd873004c019659983dfc8cccad35e63e3255946d3867721ae827f6bd7fb96a64512edb55e0fe42ec04fda1e42f6f3307c95d26b15168472b1682ee6eefea3d98eb8037a1c23874fd6f22a18e40ac28b087c960c67383d61acbb89ddec0212566fe46f2bd294e42386bc78d66f56a8f8a03f98cd2ba84761e108266d4c488939e2594e59599d10ea5b365c15a2b055423713e196ba552f9afafc236429c1b12497c22e93e81aade50397e5a61bf1c212e5da88a1d18ca764cfd4628f6eb93b0f77d44bf694d235d95ac56ec301e03fceb884314eef1ee7bf0747df178b8de90ee73bb7913c640c565b5db0f88b903b1acef5614d8c671918ce40cab2129c13186885faec99fe6103e120905fbd74e7bc71ee055cd3d8380f14b1ab3a685e73712dd799cdeee19800edea4dbdbb846e211bdf3f8d45e83e839c48c8392bf3bcd169b2952bd5775469b039fdccf3c17180869e040047806f470f03d9eb569c7e895bdecd2dbf778e823f9bd6784fbb01d5e1cf1b52be780bd7bea418b7404b399dcd0b8848b5633cc4d1b6f464e4ced593269d3ccdebbcbd04bb25d164facdd56078235dad234aefa37fdf5aa70c4fb9a1b38d0a8cfd561fab8e90a25bd2ac420be41a9d4fccbba0e115bde191bbec12f5d5d36136253c40535daaed59acc5b921e7f654251a819943d41f3e18181d070000004201868014002600ff010000000000000000000000000001f03d18ee7a42d5c0287770bcc4b6a665a70f8ea576efe1459f4a7d69389ca57338f31e0ba2d1251e15abbb0d6472f5e14cc9ed566fe99cf36fcbe569dc7dc12ed0b4dad71a0a7d32c86e2d8394e94bbdb0a8afa1d397d7efb2e6fe70929caf6c3fbaeeb25b80c768a18191caa8cc51d441f7e69fc56fe139bdada2bb91cf033d18ea2e10978c55080034007f00000146e1a828e4bb6ab1458b4ab742d0aa06677aee36027f818340da7a61e9156e130f88cdcbae67b610a71a367bed3d69f7a869cb8a3d4c1af7336b42552ce9b5f7f07a6bda4d59ce51826e76deb9a925e80d342e7f466b05e5330adf19569e1156e80caa96682dd0ca41ae77b332db304700572064e5877414007700ff0100000000000000000000000000010400358008004200", @ANYRES32, @ANYBLOB="040065800000f1d1cfc68a6cdd7ea2b8714cc51f66500a017e41343f23b41b231adc796d64c5d04be7ec5bdf596bf0aedb0a919a0e0d51df052e137008002a00ffffffff0000"], 0x414}, 0x1, 0x0, 0x0, 0x20040800}, 0x1) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) setuid(0xee01) close(0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x0, 0x8, 0x0, 0x3}, 0x18, [0x5, 0x80, 0xfffffff0, 0x457, 0x2, 0x10, 0xffff, 0x7fffffff, 0x5, 0x8, 0xfffffffb, 0x5, 0x8235, 0x0, 0x1000, 0xd1c, 0x3, 0x9f5, 0x6, 0x2, 0x97, 0x3, 0x82c9, 0x9, 0x5, 0xfffffffc, 0x5, 0x1, 0x1, 0x2, 0x6, 0x3, 0x8, 0x7, 0xb, 0x101, 0x8, 0x6, 0x7e8, 0x0, 0x8c7, 0x190b, 0x3ff, 0x8, 0x4979, 0x16d2, 0x3764, 0x10000, 0x6, 0xb, 0xffffff83, 0x6, 0x6, 0x6, 0x7, 0x80, 0x1, 0x4, 0x44a, 0xffffffff, 0x6, 0x414, 0x1, 0x6], [0x80, 0x2, 0x2, 0x100, 0x9, 0x1, 0x400, 0x3, 0x7f, 0x8, 0x9, 0x5, 0xea, 0x1, 0x7, 0x9, 0x8, 0x80, 0x4a8e8b3f, 0x4, 0xa, 0x1ff, 0x5, 0x4, 0x7, 0x7fffffff, 0x4, 0x800, 0x40, 0xd1f0, 0x9, 0x6, 0x9, 0xf, 0x5, 0xf65b, 0x5, 0x6, 0x6, 0x6, 0xfffffff8, 0x2, 0x2, 0xe, 0x8, 0x8ea4, 0x5, 0x9, 0xd10a, 0xf506, 0x1, 0x2, 0x3, 0x5, 0x4, 0x4, 0x0, 0x3, 0x8, 0x3, 0xb, 0x4, 0x1000, 0x59e8], [0x5, 0xdb4, 0x70274e6d, 0x0, 0x3, 0x0, 0x6, 0x800, 0x47, 0x7, 0x5, 0x4, 0xb, 0x2, 0x7f, 0x3, 0xd, 0xff, 0x4, 0x9, 0x7, 0xff, 0x3, 0x1, 0xfcfbfc7, 0x2, 0x776f, 0xb, 0x6, 0x5, 0xffffffff, 0x5, 0x8bc3, 0x5, 0xd4, 0x3, 0x6, 0x2, 0x6, 0x8, 0x8000, 0x7, 0x7, 0x101, 0x3, 0x3, 0x1, 0x4, 0x7fffffff, 0x7ff, 0x7, 0x5, 0xd, 0x7, 0x5, 0x5, 0x9, 0x7, 0x2, 0x400, 0x1d, 0x2, 0xffff149c, 0x6], [0x80, 0x4, 0x800, 0x9, 0x4, 0x1ff, 0x8, 0xb8f2, 0xb, 0x1, 0x8, 0x6ea, 0x7, 0x8bc4, 0x94c, 0x10001, 0x1ff, 0x5, 0x334f, 0x8001, 0xfe000000, 0x9, 0x7, 0x5, 0x0, 0x8, 0x1, 0x3, 0x80000000, 0x6, 0x4, 0x1, 0x5, 0x9, 0x6e000000, 0x2, 0x2, 0x8, 0x6711, 0x9, 0x6, 0xfffffffc, 0x7, 0x10000, 0x101, 0x8, 0xfffffffa, 0xffff68d8, 0x80000000, 0x4, 0x80000000, 0x3, 0xea, 0xffffffff, 0x0, 0x4, 0x2, 0x5, 0xfffff468, 0x8, 0x2, 0x2, 0x3, 0xfffffffb]}, 0x45c) syslog(0x4, &(0x7f0000000640)=""/167, 0xa7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000100)="0f01cf0f01ca660f3881a1007066b9800000c00f326635010000000f30b800008ed8ba2100b039ee66b9490200000f32f4660f3817d00f01ca", 0x39}], 0x1, 0x31, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x6) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xfffe, 0xe57, @empty}, 0x1c) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000240)={0x60, 0x4000000, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x4, 0x0, 0x0, 0x8, 0x40, 0x15, 0x4d}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="836bb66f", 0x5ac, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x8f, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109027d0003010880000904000000010100000a240101801f00020102092403020003010008c80524050308090401000001020000090401010101020000082402010201090709050109600201060c0725010c01060009040200000102000009040201010102000009058209ff03db085e07250100061c00"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 1: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) (async) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000001140), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) (async) fcntl$addseals(r5, 0x409, 0x7) (async) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x1000, 0x1000}) ioctl$DMA_BUF_SET_NAME_A(r6, 0x40086201, &(0x7f0000000040)='\\\'.:\x00') syz_usb_connect$uac2(0x3, 0x90, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000300000010b4041c9340000102030109027e000301048009080b00010100200009040000000101200009240108000a1e000809240d0601000203000c2403030001e002020600050904010000010220000904010101010220000905010920000a0306082501013c810e0009040200000102200009040101"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) (async) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) executing program 3: r0 = socket$inet(0x2, 0x3, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10) write$tun(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000440)=""/212, 0xd4, 0x2, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800900, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000080)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000900), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r6, @ANYRES8=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f, 0xe0000000, 0x564b043a, 0x83, 0xffff, 0x5, 0x2, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) syz_fuse_handle_req(r6, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x121d01, 0x82) dup3(r8, r6, 0x6700000000000000) ioctl$FS_IOC_FSGETXATTR(r8, 0x801c581f, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000040)="9a020000007b000f20c035000000400f22c0c4c3f95c8853b5d9b0000f79dbb9800000c00f3235000100000f30f30fbc3bc4e299b72c200f21e266baf80cb8be3d8d83ef66bafc0c66edc4e2b9dc10", 0x4f}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r5, 0x8010aebc, &(0x7f0000000300)={0x6000, 0x100000}) executing program 0: setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0x2cbdda69, 0xc}]}, 0xc, 0x2) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) writev(r0, &(0x7f00000004c0), 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000040)={0x0, 0x2008000}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0xc0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000300)=@gcm_128={{0x304}, "793ba630b2de12f8", "c638280e9b39583cc7fd269640bc0334", "36ebbafd", "cf5506fd54cac505"}, 0x28) write$binfmt_script(r3, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x1007}]}) timer_create(0x2, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$inet6(r2, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffc, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000700)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x2}}}, @dstopts_2292={{0x18, 0x29, 0x3b}}, @hoplimit={{0x14, 0x29, 0x34, 0x9}}], 0x48}, 0x0) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 32: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x4, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001400010000000000000000000a0000000400000014000100ff01000000000000000000000000000115000680bf74a7dffd"], 0x44}}, 0x0) executing program 1: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, 0x0, 0x0) sendmsg$tipc(r0, 0x0, 0x20008081) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r7, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="51b0250c0000000800030000000000000000", @ANYRES32=r9, @ANYBLOB="0c009900faffffff6b0000000a000600ffffffffffff0000200050800800070003000000090001007fe022d63c000000080007000100000004002800"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x8000) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30, 4, 10, 33, 19, 10, 14, 16, 30, 30, 8, 15, 16, 30, 6, 14, 18] detailed listing: executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0xa400, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000140)={0x600000000000000, 0x40000, 0x0, 0x8, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0x11, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000180)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r4, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000001980)=[{0x0, 0xdd12}], 0x1}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000300)={{0xeeef0000, 0xdddd1000, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0xff}, {0x3000, 0x0, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x4}, {0xdddd0000, 0x10000, 0x9, 0x0, 0xff, 0x4, 0x6, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0x0, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x8000000, 0x0, 0x0, 0x1, 0x1, 0x83, 0xa, 0x26, 0x5}, {0x4000}, {0xdddd1000, 0xff}, 0xddf8ffdb, 0x0, 0x0, 0x70, 0xfffffffffffffffe, 0xd801, 0x0, [0x0, 0x0, 0x1]}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x7, 0xfe, 0xe1, 0x0, 0x6, 0xd9, 0x40, 0x1, 0xfb, 0x8, 0xc, 0x0, 0x0, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x0, 0x20, 0x3, 0x0, 0x106c, 0x80000001, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x0, 0x8001], 0x1, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 1: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x0, @private=0xa010100, 0x4e24, 0x0, 'lblc\x00', 0x10, 0x8d, 0x1d}, 0x2c) ioctl$EXT4_IOC_GETSTATE(0xffffffffffffffff, 0x40046629, &(0x7f0000000040)) (async) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000080)=[@nested_vmlaunch={0x12f, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0xb64}}, @nested_amd_clgi={0x17f, 0x10}, @nested_load_syzos={0x136, 0xb4, {0x3, 0x5, [@nested_load_code={0x12e, 0x5c, {0x3, "f30fc772b0f3ae66b876000f00d0c461a5e170060f79445c0eb9cc020000b8ce000000ba000000000f30f20fd05fdd420f78ad4f470000c48175fe631326660ff37c8406"}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x537, 0x5, 0x1fb3, 0x7fffffff}}]}}, @nested_amd_stgi={0x17e, 0x10}, @nested_create_vm={0x12d, 0x18}], 0x11c}) ioctl$KVM_CAP_HYPERV_SYNIC2(r0, 0x4068aea3, &(0x7f0000000200)) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000280)=0xf9) (async) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r0, 0x4068aea3, &(0x7f00000002c0)) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000340), 0x2, 0x111040) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000380)={0x37e3, 0x13, [{0xa, 0x1}, {0xa, 0x1}, {0x8}, {0x7}, {0x1}, {0xa}, {0x5, 0x1}, {0xe, 0x1}, {0xb, 0x1}, {}, {0xd}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x8, 0x1}, {0x1, 0x1}, {0xe, 0x1}, {0x3}, {0x2, 0x1}]}) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET_FEATURE(r2, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x3fa, 0x400, 0x70bd25, 0x25dfdbff, {0x1, 0x1, 0x1, 0x1}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x80) mmap$usbfs(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x30, r1, 0x5f89) (async) mmap$usbfs(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000000, 0x31, r1, 0x71) (async) r3 = memfd_secret(0x0) ioctl$KVM_NMI(r3, 0xae9a) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500), r3) sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8806}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xc4, r4, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffff71}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfff8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5ad}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5f5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffc0}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20008051}, 0x800) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wpan3\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'wpan3\x00', 0x0}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) (rerun: 32) sendmsg$NL802154_CMD_NEW_SEC_DEV(r5, &(0x7f0000000900)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0x90, r6, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVICE={0xc, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0xb}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_DEVICE={0x40, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_SHORT_ADDR={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6}, @NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0x2}, @NL802154_DEV_ATTR_PAN_ID={0x6}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xffff}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x80) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000980), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x20, r10, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x66}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x44090) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000b80)={&(0x7f0000000b40)=[{&(0x7f0000000a80)="3bdcf97de6d0666e9a51108bdd7bd3bf655616719623717edae1be4a82678cf2a9e3087b18c297a87a993995b4f192f0e79d3eff6d9a0f75806ba8f98b8bf4bf32b1ed61", 0x44}, {&(0x7f0000000b00)="446c6d3a86e0a2fdbd7b6c6c71e449fb97ebd746418db4", 0x17}], 0x2, 0x8, 0x0, 0x8697, 0x5b32, 0x2, 0x3, 0xf}) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000c00)) (async, rerun: 64) r11 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000fc0)={0x0, &(0x7f0000000c40)=[@uexit={0x0, 0x18, 0xc24f}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x4fe, 0x5, 0xd8, 0x4}}, @cpuid={0x64, 0x18, {0x4, 0x10000}}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xa6, 0x6, 0x7, 0x1}}, @cpuid={0x64, 0x18, {0x5, 0x7}}, @wr_drn={0x68, 0x20, {0x6, 0x6}}, @rdmsr={0x66, 0x18, {0x22e}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0xcd17}, @nested_vmresume={0x130, 0x18, 0x1}, @wr_drn={0x68, 0x20, {0x7, 0x7}}, @wrmsr={0x65, 0x20, {0xa3f, 0x8000000000000000}}, @code={0xa, 0x50, {"b9800000c00f3235010000000f30660f3880410cf3420f01798d440f01cb0f9683530000002e2e66430f62ef660faef30f20c035200000000f22c067a70f08"}}, @cpuid={0x64, 0x18, {0x3, 0x4}}, @out_dx={0x6a, 0x28, {0x463d, 0x6, 0x2}}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_load_code={0x12e, 0x6b, {0x1, "0f20e035000002000f22e0450f783066bad104ecb805000000b9070000000f01c166b80c010f00d866baf80cb8a065198eef66bafc0c66ed650fc7b806880000263e420f01c2f30f2ac4c4c13575bd1f626c99"}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0xb05a, 0x7ff, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x482, 0x8, 0xfffffffffffffff9, 0x6}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x808, 0x9, 0x9, 0x2c32}}], 0x36b}) (rerun: 64) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000001040)=@arm64_sve={0x6080000000150488, &(0x7f0000001000)=0x1}) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4001af83, 0x0) syz_usb_connect$uac1(0x3, 0x87, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000002082050c004000010203010902750003010600950904000000010100000a2401d4000a00020102090401000001020000090401010101020000072401f5f900000e2402030604b1020c47148017f309050109100007010c07250104070400090402000001029f89c965ea4570000009040201010102"], 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000180)={@initdev, @dev}, &(0x7f0000000280)=0xc) (rerun: 32) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) (async) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x64, r4, 0x4, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x1, 0x34}}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x100}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x18, 0x2d, 0x0, 0x1, [{0x14, 0x0, @random="32a910e3c2ed2d0038d7e9a178734127"}]}, @NL80211_ATTR_SCAN_SSIDS={0x1c, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0xff000000}]}, 0x64}, 0x1, 0x0, 0x0, 0x811}, 0x8001) (async) recvfrom$inet(r2, 0x0, 0x0, 0x1, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="20000080", @ANYRES16=r1, @ANYBLOB="21032bbd7000fcdbdf25040000000c0001800800030003000000"], 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f00000000c0)={0xd5, 0x0, 0x10}) setgroups(0x0, 0x0) (async) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000080)=[0xee00]) setregid(r3, r3) (async) setregid(r3, r3) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x83, 0xffffffff}) fchdir(r5) (async) fchdir(r5) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) (async) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xa2) r6 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f00009ef000/0x400000)=nil) setuid(0xee00) syz_kvm_add_vcpu$x86(r6, &(0x7f0000000180)={0x0, 0x0}) getpgrp(0x0) (async) r7 = getpgrp(0x0) syz_pidfd_open(r7, 0x0) (async) syz_pidfd_open(r7, 0x0) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') (async) syz_open_procfs(r7, &(0x7f0000000400)='net/anycast6\x00') clock_gettime(0x0, &(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000580)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000008440)=[{{&(0x7f0000000040)=@nfc_llcp, 0x80, &(0x7f0000000880)=[{&(0x7f00000001c0)=""/216, 0xd8}, {&(0x7f00000002c0)=""/46, 0x2e}, {&(0x7f0000000300)=""/202, 0xca}, {&(0x7f00000005c0)=""/166, 0xa6}, {&(0x7f0000000680)=""/242, 0xf2}, {&(0x7f0000000780)=""/133, 0x85}, {&(0x7f0000000840)=""/54, 0x36}], 0x7}, 0x1ff}, {{&(0x7f0000000900)=@alg, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000980)}, {&(0x7f00000009c0)=""/207, 0xcf}, {&(0x7f0000000ac0)=""/154, 0x9a}], 0x3, &(0x7f0000000440)=""/204, 0xcc}, 0x7ff}, {{&(0x7f0000000cc0)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000000d40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/114, 0x72}, {&(0x7f0000001dc0)=""/75, 0x4b}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/221, 0xdd}], 0x5, &(0x7f0000002fc0)=""/112, 0x70}, 0x7}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f0000003040)=""/162, 0xa2}, {&(0x7f0000003100)=""/106, 0x6a}, {&(0x7f0000003180)=""/9, 0x9}, {&(0x7f00000031c0)=""/4096, 0x1000}, {&(0x7f00000041c0)=""/233, 0xe9}, {&(0x7f00000042c0)=""/224, 0xe0}, {&(0x7f00000043c0), 0x33}, {&(0x7f0000000bc0)=""/21, 0xf}, {&(0x7f0000004440)=""/238, 0xee}], 0x9, &(0x7f0000004600)=""/39, 0x27}, 0x7}, {{&(0x7f0000004640)=@xdp, 0x80, &(0x7f0000004840)=[{&(0x7f00000046c0)=""/166, 0xa6}, {&(0x7f0000004780)=""/151, 0x97}], 0x2, &(0x7f0000004880)=""/209, 0xd1}, 0x9}, {{&(0x7f0000004980)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000004a00)=""/176, 0xb0}, {&(0x7f0000004ac0)=""/221, 0xdd}, {&(0x7f0000004bc0)=""/222, 0xde}, {&(0x7f0000004cc0)=""/120, 0x78}, {&(0x7f0000004d40)=""/99, 0x63}], 0x5}, 0xfffffc00}, {{&(0x7f0000004e40)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000004ec0)=""/4096, 0x1000}, {&(0x7f0000005ec0)=""/4096, 0x1000}], 0x2, &(0x7f0000006f00)=""/189, 0xbd}, 0x401}, {{0x0, 0x0, &(0x7f0000008180)=[{&(0x7f0000006fc0)=""/25, 0x19}, {&(0x7f0000007000)=""/110, 0x6e}, {&(0x7f0000007080)=""/4096, 0x1000}, {&(0x7f0000000980)=""/33, 0xfffffffffffffcd3}, {&(0x7f00000080c0)=""/178, 0xb2}], 0x5, &(0x7f0000008200)=""/127, 0x7f}, 0xffffff99}, {{&(0x7f0000008280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000083c0)=[{&(0x7f0000008300)=""/126, 0x7e}, {&(0x7f0000008380)=""/27, 0x1b}], 0x2, &(0x7f0000008400)=""/42, 0x2a}, 0x20}], 0x9, 0x100, &(0x7f0000008680)={r8, r9+60000000}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000086c0)=ANY=[@ANYBLOB="54010000100033060000000000000000fe8000000000000000000000000000aaffffffff000000000000000000000000000040000000800400000000870000008792b3fb71e9dd6682007a6eeb5d6bb0a11c0d730b1d923544e3fb58896bd9f30f6c444052475643042c9ea65f771e6c612d29f254a677a996b9c30cfa10", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14143f0000000000000000000000000000000032000000fe80000000000000000000000000003f2703000000000000090008000000000000000000000000000400000000000000ff0f00000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008f000000000000000800000029bd70000000000002000100000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040002005e2100000000ac14143f00"/268], 0x154}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000008d00)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000008cc0)={&(0x7f0000008880)=ANY=[@ANYBLOB="140400004100000425bd7000fddbdf250f000000080098800400d7800c001900070000000000000041000980f99cfbfeb22d74ebf640d9fb411027a99daff104007380267b80c40b0edfe486cc0c00190004000000000000000c005500000000000000e7680400588000000008004d800400398019022e80a0005000d137aeba257b37999d81b545df8765d2cee0d5ac19139ef99a9d80e95d44f66d1572cd873004c019659983dfc8cccad35e63e3255946d3867721ae827f6bd7fb96a64512edb55e0fe42ec04fda1e42f6f3307c95d26b15168472b1682ee6eefea3d98eb8037a1c23874fd6f22a18e40ac28b087c960c67383d61acbb89ddec0212566fe46f2bd294e42386bc78d66f56a8f8a03f98cd2ba84761e108266d4c488939e2594e59599d10ea5b365c15a2b055423713e196ba552f9afafc236429c1b12497c22e93e81aade50397e5a61bf1c212e5da88a1d18ca764cfd4628f6eb93b0f77d44bf694d235d95ac56ec301e03fceb884314eef1ee7bf0747df178b8de90ee73bb7913c640c565b5db0f88b903b1acef5614d8c671918ce40cab2129c13186885faec99fe6103e120905fbd74e7bc71ee055cd3d8380f14b1ab3a685e73712dd799cdeee19800edea4dbdbb846e211bdf3f8d45e83e839c48c8392bf3bcd169b2952bd5775469b039fdccf3c17180869e040047806f470f03d9eb569c7e895bdecd2dbf778e823f9bd6784fbb01d5e1cf1b52be780bd7bea418b7404b399dcd0b8848b5633cc4d1b6f464e4ced593269d3ccdebbcbd04bb25d164facdd56078235dad234aefa37fdf5aa70c4fb9a1b38d0a8cfd561fab8e90a25bd2ac420be41a9d4fccbba0e115bde191bbec12f5d5d36136253c40535daaed59acc5b921e7f654251a819943d41f3e18181d070000004201868014002600ff010000000000000000000000000001f03d18ee7a42d5c0287770bcc4b6a665a70f8ea576efe1459f4a7d69389ca57338f31e0ba2d1251e15abbb0d6472f5e14cc9ed566fe99cf36fcbe569dc7dc12ed0b4dad71a0a7d32c86e2d8394e94bbdb0a8afa1d397d7efb2e6fe70929caf6c3fbaeeb25b80c768a18191caa8cc51d441f7e69fc56fe139bdada2bb91cf033d18ea2e10978c55080034007f00000146e1a828e4bb6ab1458b4ab742d0aa06677aee36027f818340da7a61e9156e130f88cdcbae67b610a71a367bed3d69f7a869cb8a3d4c1af7336b42552ce9b5f7f07a6bda4d59ce51826e76deb9a925e80d342e7f466b05e5330adf19569e1156e80caa96682dd0ca41ae77b332db304700572064e5877414007700ff0100000000000000000000000000010400358008004200", @ANYRES32, @ANYBLOB="040065800000f1d1cfc68a6cdd7ea2b8714cc51f66500a017e41343f23b41b231adc796d64c5d04be7ec5bdf596bf0aedb0a919a0e0d51df052e137008002a00ffffffff0000"], 0x414}, 0x1, 0x0, 0x0, 0x20040800}, 0x1) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) setuid(0xee01) close(0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x0, 0x8, 0x0, 0x3}, 0x18, [0x5, 0x80, 0xfffffff0, 0x457, 0x2, 0x10, 0xffff, 0x7fffffff, 0x5, 0x8, 0xfffffffb, 0x5, 0x8235, 0x0, 0x1000, 0xd1c, 0x3, 0x9f5, 0x6, 0x2, 0x97, 0x3, 0x82c9, 0x9, 0x5, 0xfffffffc, 0x5, 0x1, 0x1, 0x2, 0x6, 0x3, 0x8, 0x7, 0xb, 0x101, 0x8, 0x6, 0x7e8, 0x0, 0x8c7, 0x190b, 0x3ff, 0x8, 0x4979, 0x16d2, 0x3764, 0x10000, 0x6, 0xb, 0xffffff83, 0x6, 0x6, 0x6, 0x7, 0x80, 0x1, 0x4, 0x44a, 0xffffffff, 0x6, 0x414, 0x1, 0x6], [0x80, 0x2, 0x2, 0x100, 0x9, 0x1, 0x400, 0x3, 0x7f, 0x8, 0x9, 0x5, 0xea, 0x1, 0x7, 0x9, 0x8, 0x80, 0x4a8e8b3f, 0x4, 0xa, 0x1ff, 0x5, 0x4, 0x7, 0x7fffffff, 0x4, 0x800, 0x40, 0xd1f0, 0x9, 0x6, 0x9, 0xf, 0x5, 0xf65b, 0x5, 0x6, 0x6, 0x6, 0xfffffff8, 0x2, 0x2, 0xe, 0x8, 0x8ea4, 0x5, 0x9, 0xd10a, 0xf506, 0x1, 0x2, 0x3, 0x5, 0x4, 0x4, 0x0, 0x3, 0x8, 0x3, 0xb, 0x4, 0x1000, 0x59e8], [0x5, 0xdb4, 0x70274e6d, 0x0, 0x3, 0x0, 0x6, 0x800, 0x47, 0x7, 0x5, 0x4, 0xb, 0x2, 0x7f, 0x3, 0xd, 0xff, 0x4, 0x9, 0x7, 0xff, 0x3, 0x1, 0xfcfbfc7, 0x2, 0x776f, 0xb, 0x6, 0x5, 0xffffffff, 0x5, 0x8bc3, 0x5, 0xd4, 0x3, 0x6, 0x2, 0x6, 0x8, 0x8000, 0x7, 0x7, 0x101, 0x3, 0x3, 0x1, 0x4, 0x7fffffff, 0x7ff, 0x7, 0x5, 0xd, 0x7, 0x5, 0x5, 0x9, 0x7, 0x2, 0x400, 0x1d, 0x2, 0xffff149c, 0x6], [0x80, 0x4, 0x800, 0x9, 0x4, 0x1ff, 0x8, 0xb8f2, 0xb, 0x1, 0x8, 0x6ea, 0x7, 0x8bc4, 0x94c, 0x10001, 0x1ff, 0x5, 0x334f, 0x8001, 0xfe000000, 0x9, 0x7, 0x5, 0x0, 0x8, 0x1, 0x3, 0x80000000, 0x6, 0x4, 0x1, 0x5, 0x9, 0x6e000000, 0x2, 0x2, 0x8, 0x6711, 0x9, 0x6, 0xfffffffc, 0x7, 0x10000, 0x101, 0x8, 0xfffffffa, 0xffff68d8, 0x80000000, 0x4, 0x80000000, 0x3, 0xea, 0xffffffff, 0x0, 0x4, 0x2, 0x5, 0xfffff468, 0x8, 0x2, 0x2, 0x3, 0xfffffffb]}, 0x45c) syslog(0x4, &(0x7f0000000640)=""/167, 0xa7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000100)="0f01cf0f01ca660f3881a1007066b9800000c00f326635010000000f30b800008ed8ba2100b039ee66b9490200000f32f4660f3817d00f01ca", 0x39}], 0x1, 0x31, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x6) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xfffe, 0xe57, @empty}, 0x1c) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000240)={0x60, 0x4000000, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x4, 0x0, 0x0, 0x8, 0x40, 0x15, 0x4d}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="836bb66f", 0x5ac, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x8f, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109027d0003010880000904000000010100000a240101801f00020102092403020003010008c80524050308090401000001020000090401010101020000082402010201090709050109600201060c0725010c01060009040200000102000009040201010102000009058209ff03db085e07250100061c00"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x72, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040010}, 0x80) (async) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x40001, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, &(0x7f00000000c0)=0x104, 0x4) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001"], 0xfdef) (async) r11 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r12 = dup(r11) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = dup(r6) ioctl$PTP_EXTTS_REQUEST2(r14, 0xc0603d06, &(0x7f0000000040)={0x200}) (async) ptrace(0x8, r0) syz_usb_connect$midi(0x3, 0x59, &(0x7f0000001f80)=ANY=[@ANYRES8=r1, @ANYBLOB="343fc0c99291f0869161e84d8093cf44530b4466b27115d9e455c1eda5a374dc44401c030880c1771d33b6e8aa0778cdd2f8fcf7965b1a32f22fb2438d72dec4b15a7e45f8b493fcd4fdda5387f782564ab394989dccbc19c0ccc09aff3004da794399fe7531052961ccff32d264d3c7df6f00b289efb737536ead23e4a13ab25e73accd417bb3455251da97bc4cbc76cc90b93bd3b2ca6e90bbfb8c6cc10f0fb877ba2d9f6cc9632beb95b6eb9bd3df9fea9c03e0811218f7ae", @ANYBLOB="28da9a2f1cc736a94ed3722124928652cfcdc4b1d31fffe1fe385b66843b381d607bec4f5d7439f3b64f1a22e05d762c36a5afc747ef25e42cc4609223e3145a411f6d3f507a11a6f1282f812cdb65764bc076df328eff96a90a8433804e86bd8b60d5f4b191ffa4a895c2f864971a13d3c7133ee5c5778760c4f2581bbd69226435115c8b49848bcbb75a799cbb3023a8de299e6261a55e5fc93b30d1d1c7ade71b663badab4c13b5463b522061d4f2142aeaf17ad66198c8bfe5a23dcf65b0f06e49ccb81643a0822ce8097795a786fd8c02a9f0ee4949d6bdbc8d00a4bf78093a788f870c825ba8bb70ac808295bcff1b58e0be77ce888b504df176d0be5c633907719dba3e670a70abf48878ddc24388307d56d25c9c884b52b917d0c1558393b89bad24614f14ac26eb2608239e39abaa0ba07b740c93411f4a00bf543ae240a40670f1c68bea0f3697efe211ed4e6c63bab529be5f7c9336763bd827646a57003c8c9f5d2c6bd99abdf1e3049a964bd9d5eaf94b22783c2e8302c665d7a74ad3eb9e8f0ca40ddc4a3d73125f6cd47307518dbf68a2850b6ec1abc90189456212695f2bf4364fe65b9d191e525a7c2b6e7280135dbe288e2b91140e067866f16e2a0e7ddee25a3fdd1959267a6d29be4141c8b0ac9ebab51f17bcbb231a65c23d5c2736e6fdddd292ba67542cb7fa60842c231fa94e17c27b3d6c1a81c6c0d9949c7abdecff8eb4b21af1a8a222302b18777150432e1e41c41aa1ac5c7efcf6e7a4292314d750ce9ea394af8c0e11fa5f4855e8f81319833ce2e6b374e4ad486421c6ce1be1d6f66d0ae0b7abf00dc1df8ea274d2489e0207e4a7fc243ac7e89b7f81ebd30d33efb55b09c12bf6312e08d45c8b815c64c6401ff92a006416839a374923ed0271935f0ee078f39b7c57121adac47439696d6e6d20886ca18b41b258cc9f6659cab48c9b9c10404c4abb4244f85fc19d41d319dceb9fdcdebb5220200380b70653eb8690282e21d9407a2f53f086053ea64c97f8d6c349dea23a1acc8b4d3b7756142fbcd3eddecbf98f61a0becd9446c71902648b2f0114d2609c31d870335f9553159c9e410d95f0abcb0f72dc55b4bf7357efe95758939179f7d18db4f0c65a064b3caf49325a0bfe9fd893736dea950d5c9e48532896498a89e655d844a0ce8a2fbd647c6f73ff062923999456a73124e8e3db9e140f2a15327c49e1dcdcb949f7905c84be68c2f766f252de885c5885a9cc2bcb17af8ae9c9b6f9bddb96088bb266281cc83910c08f3bb3bd30804490de5fce35b3d5db215e830ca1505f489f045e4f3175bb0deefc68828bfee3ed012bc874c374aaa44af7cee4558b2d77dc910bbfef3a732994270a1a4fa23042826e88568e06c9241365cee3fd2a121af0890b0a362f1d51aa8ba88cf4efc082c5d5da85d476232e0bf8c0cbb204e42c22b61b83de897e4040d21c45352e5cedc0e52aaba5ba74865ed5d98d51beaff39c8db11563c48251d2bbc0813a53aa7c7a1e08f7d263981c485bc70e79714bbc28c7c3f2750a22f6ceb6ad06ff265c634ac79bd7e642304d94a2a3e08594e45be43ed98c7ec1443a438ca3cc8d0ffb1e7e64983cb803bb5eaa9c901566b6d82bf7283d7cb8d929a9e9321f9ff1d0f519446e99199d01768274e25509cf9e0677b19bbe177926c196bbb000f7dee9ee614f83ac5a746c3ca4a86e7e54569831d2a25c348aa0baa6d8ad1f545a66b1f0f3b7fb8a35bf5351f6c4cb712e075213c4a1904f014a298221362d3f925736937f895ea99377d7ba5f04035748f24eba740f6072eac621c0de7050f0208d4f45b746ffa1bb5fbc45d06061d69cfd3c824773500e59cc7ffaeeb6b2c55f928f65fc8b9463745e4267bc6c9f470ebcb1a9bfab36f1f5d59e5d277de81994a3c03864bf8c53f2f389dc8392ff8e1d395ebbaf79e666dde57c32db18a4157f36395458b3d32830e41152be32141958bd546a026aba13e26f120ebafd822f0383504be687967191a44e23b433cf87f7e3929f804801d2158910017cab987bea6076d02a5f95775d2b8950d6c937f9e2d4bba33859e0e03119dc2e340b9ac05cdcb2f1b77c6e88ffa24f4490a263191136fcb97ca61e24a7fef9631286ff7f2f5e8896a3a2015f85b51f05a47fba39e0e3b67e3284e7aedb0832e4a95b6c85e246d53bbb9fd8d5355f70c50bd63f3546acbac7214951be91f6d2e5d9f86a7c253e2e7e04b6fca79c5f96a30d538495c38aa5aa5686969f9aa47c941148142c3bfe7c346e9485bcc66bf9cd681f3eb4cc9887ec5b1adb10317c72c91d56af45c44b964b7c95a3910c97590391b0f232663de62df1e564e98cf46762257af39553ac67d0e42072b1e645072f5715c490a975cf0d74ad4b88e69bc645f16ae1d6861e3ff6e948e4d9b958b95e961e4e79017f45d2b4693921f51e70c493626d0487f1cfd9219cf21c9934d43bd9d19bb02612b5dde8e0b9ea40d9cbf92dc2c2030be22b15feea3f38c1a8747cd8f4db094ece65ff483f6119d9ac76b6c05480b118cad118ceb63142224745d78d17d9c0db7b78a8dd17d46275f00649722b2a9a9bf79dae7e1dd3877ee447c9aaa56999837751f2209406fef2c6e2b7da3a9317edf91d2434b4302916715fdb9814a05d1f89b8f144cf067082e72cd83eb9105e421cdd3e335abc966fedc142297e2c4b4200cdddbfcca3fd5e8b9147b9437651c5f6a2e2b98649d948ce5c23cec4c102510555267b1b12678785a32ead402f593369ae34cc01003d7c6f774ad7f1f9fe10e4d9ef70d0aec1be368b94763b34ceaf3bd49e858892690606702ff7a77cc5c1db5bd143dbb0d48bac438e385c009f34775e9b647e514a8e8ffc7f2dfd4abae69e81ac5effbd55c1d2aaf0277170c66ac49f905fdeb6be4562fc4d80f84e6286d36d0a72af97625bff767ae228d7369c8d6c30244ca0d304c53496ecd6443cd097b119559c417b857748594faa2599f80c0ef59422f48cb412cb8636947473faa47850a91b620b3249560837049a82a4f5c473911ca43ccff3ad38af7dee570bfce3ff8884194d8d41d39b3a94fb528a707fd294bb743f5cf52e9e9b3ed939dc6aa1f9695025e47ec4636d6ce3f0fc00ce3ac4bb00d8d9d381520c4eebf4fcf1ba56094fa81132baee3895a08736be4aa63056841462ba5817391c44686d9b0c9569c583ea721e5e6d6995a9ea3dd07229ab40f2b58d971a93db9aa4fdedaa150384d348af0737e655d4edea0fd4d1d826956bf443d977ad7a30400f76ea7246af9654fa98ffabdcb52690b0edfdd65355ad8ea764cb3097303a504b7ed9fe49516b5410de36e0acd0bf6259aed94f1efcadaf0494d40224f9f3214e2bb373675e0c5734f63bcd382ac88cdbb7468d3eccbd4707da5e85537820e32011c575fe1c9da18b657f1a2cd63c1f63d917894fa8ab621c5b0b9732d50b7d41a42e7fc9db63a0679bba66053ec909d92e55c732fa8fd5ad997a3b55dda0fb820c400f86b8c07f94c2705ac0005991c55f4a3618cff989640b3f80207c316214ccd279bf1884ef232811c145ea5ff360bbba3292af78224bcdc4baedba91385a6bed8fd6c74f265c041d141cbdc289dad3562014c33851d449ed84a75e9facdee30ee4b6b216053ca20598ad380ea77c43459aad1a4d1cdc8c0206b14de51d382cb3bfb1af26f06a573857dcdbbe73ac4b1e0d75a7edd0d36129c570a94fec60a468c0eea0a80cafc1e996d5ceea1b92bff21d3706ee6b35eab4802f347849852a19cc60abd72ff69e3db985caf2030bf84762036a4dc2ed2b3883df616c28f6a715e82100c200ff5ed6900f7b2f5a27663d268bd8d1f8c25b276e78d1c5e39d4ea2506bab4a38f110a5ac85ace6d7001d8fe5044a2b519c38ff404d6e38080eb4b65633fccf810e7d59ccc2f3186bf70f1f5cea3eeb18ab97676db67488fa3139f4969d33a8e27271b1427e5028fd1b4b68ed5e108c0b2734ddf0966fc91074cfd048db6acc87f9e57ba873e0f3403315a2598ae6089b199f5d5dafe655530fe9df513016dfd1064fab61741ae28f0875fd25e85def18a6f7ee52ebb876627099f63411fa7a3580db990f1b44963afc347540e6830c9c4f88389710050ff9927d3138cdce5be9043596903656c5283682006c210e3a7e93c2cfd5e9bf1a3d82e4f690b36fbf5da0240ce5539ec4c6d7cff734e4cfafc695d461fb8a039c7d86dbdaa484972f05eefe286099415ea09ae4dbe01d29f252134f96f924a68f07e8c5928d01a2ecb6b71b522b168a8e9be2263e05fedf5eebdd19148ba2cd715a0f258ee8384dde52b465fe6dac627e6228870027902c09557becac07201e4cab0a5c5beea51e9020cd988e9ef0ef008e70bf06e818d5f4319239659b24a442070d068e61710ed52bc32b60a3470ed9b50eca1c7100a9392b9fca09981b05523dfaf504d3ed38844b1dc30c0b0fad415036c7ba0af7494c4f7f6d5f416ebbf1751e0a192bf3fd88483f5420e6cf1eac8b3dd717df521aea3775063b47dd1b74fd55ea41b21b48fea4d5cc19abb0a832c789a1f26c38a13f92bfcaea7c8ea38b256a3f90e6d48cdb5f887f6a36c9741e2e3d78f912ab730364f0a27e5894118ae3cbb3b03c8cf558e8f151091bc316aa9bff2f2796f74e64d9e2f09e328d83b28443f80e5f06c0e05e49b4aa2306d12899c04c4c19c10946a1addbd4773e71461bb0cbd86cd3db65fa66219932b307f64dc899416038d16f2c59ccd8dc0c28f80f43261539e5e75702aeec05288f3c0f3a172c62789f5d2781c32a981618d0080bef0361baa5a88bac9c500c87e944036e8862e363e47a43ab7ffbb4a27bd8bdb62006109675c4d04634fa16d22161fb248ac063a312fb98a2e79db2d0cc2571bc751c2847f631ebf1872067b062c0ab7d72520f2a0f0b61a59bc41e0464260ba3617fd50367b3d6bf6d58d906c025dd875ae0807769e1292be8c0167a3bd96db0ab6eb0c6e0065d08998633b5ae5a3ac166cb20d24ac673ecabc027f3dade542c80f5c0db05b6ac05feeed5f2d1524989543a2cf32eb6867532aaaf3526a24eae749bf1d1b1f00f349fd63b6db89c12e0ff8babf695c52e794afc1abed8430ede135b27430224882747abf8ef669bc4da36812c141944d2351cc277a7f500961f5fa5159ac57eafdce7c198457996323193f02bf1e6aefe069849582da635ef0dcbe4518881749a11440e9aa5927c672d7626ef286c69f5637f9a963a766469092a1921d5b2e8265ccd4840fadfa6da8087928e29f02f5c8abb90b983b5b5fda5737725fd6294567e68a8d02eb2a677426b1b89cd4db302562dcd9a47c1b29bfc91730b7374f129688009a6e699e865ab88c34e02e1cb3ed30fd5ce11d1225790aca77e3c1b486a49b8c46cd79b0da6ddce7262f87d45496bcfe86a64965c77b4c9e42001800a150ef49ce179a945d18b276ead9c45b554ffd71e2ed07f4380dd94b0c737ebeeae1fca5317ded582df0d0e3bf11e9267fe6a17e6de8672181f07d345e032d4f9a21ce9c7e67e781e99576babbfd6a40b1f5db8bb38d6b7c0b2e2fc6b5dfecd4ca96428327b0c349d83b8a70d44895af1a0f3de1ceaa7ce8a8caa548c60d50fc46ca34f85c22577869e80358d91c132da69e987665f59cbe8b2ca84e84c33d17bdcf8dbc818a2c8b924860856da0a77a640d67a1d4a4c066f5d98497bb2ff911efa3651439fbba9bdd626bcf4161e6f0d94110533d9730b0ba4da477ced060ed7c9d0fea7b1075da476c9ab5405b7c4a9ee2b8a74e4d1944a5b8ae2a935fecf0b171c5217f67dfad8348da2a2bdee860ad3dc2bba05e6a9b48312fe5edb59dff246f2", @ANYBLOB="4434cdbcc5f4778531d1"], &(0x7f0000003500)={0x0, 0x0, 0x0, 0x0}) executing program 0: syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYRESHEX=0x0, @ANYRESOCT], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NILFS_IOCTL_GET_CPSTAT(r1, 0x80186e83, &(0x7f0000000300)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000002000000600000008000300", @ANYRES32=r3, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040001}, 0x40801) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="5a53fe8e378bea61e8796d39bddde5ee79ed541be00f01305ec9ef082be00b20488edce2c5b4f11dc6f81445e4b349bff8bc6a5cb6cc98280a2844fc072193c4681477d7dda4c7c32f38c922f5d26aebc3aa03a3a69e705ddcad7af27ce8c90fa0f759a4a7c99aabe8b3ae6d0f38bca66b08c1f567ed57dd992c5831ce31186123d77d2a844c9ef3ee20f91b18185aab198fc5f4b40cd74692d0da807f67269bcc2c123e90999ba4f7b1d82c5e91b6061322ca4bbfcbf4ed897c4d972160aa307f8278a788125651cb6c0ee0a2d7fbbb62b6d763a9b5071f9e274e5f6871341123d8e6cdf528f3a762b1e00ac4d7897732f0dc29f4b7d7c041d5b48e4055e11b3d89506c685ac71643432e9dba15727157c3d6a5c2b6aabda6c9f6bb8e0827104d0000000000977b4424641e9c9dcf9d0b298563", @ANYRES16=0x0, @ANYRES64=r2, @ANYRES32=r3, @ANYBLOB="0c00118004000600040006000c00bd00ff7f0600010009000a00060008021100000000000600ed00a2020000280011800400070004000200040002000400010004000300040003000400010004000300040003000500c200090000000a0006000802110000000000"], 0x84}}, 0x800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x537d2ba428f33b01) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYRESDEC=r1], 0x18}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0xc0109428, &(0x7f0000000100)={0x1, 0x5c410c3c}) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x6d) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc0000000000000000000000000000000a01010000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x40004) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x2520, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340), 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000240)="db2d82e6036cbb7e31105314a0fe5f5989bce02d44c1641ffc1cd7d99f6d010251ce2340064f5cac4f96a73d6983035797d24dd1d5f72084b2979a327b1631b445d3ca60d4a2d216cf6a20bf4c449b790b1cea906d2c8203173bb46f2d23ee787772e35c17223f0f1dfc8faab1a7e7d53b3f1839a3f9ec10e980f3c0e89e808b4641aacc977b69172e7ae9efb164c872a29124d879022a25237a", 0x9a}, {&(0x7f00000005c0)="6c43a715ebbd318addcd79db30fc82c7897cc1af4d30ef0c0793f7", 0x1b}], 0x2}}], 0x1, 0x24040015) r6 = socket(0x28, 0x801, 0x0) shutdown(r6, 0x3) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) readv(r0, 0x0, 0x0) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) getpgrp(0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x0, 0xc0107520, 0x20}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000b00)) executing program 2: mkdir(&(0x7f0000000000)='./file0/../file0\x00', 0xa383bdae8a56c7c6) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r0) tkill(r0, 0x12) ptrace(0x4208, r0) tkill(r0, 0x12) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xe01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x3) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x400005, 0xd, 0x100000001, 0x646, 0x80000001ffffc, 0x5, 0x7, 0x8, 0x8, 0x8, 0x3, 0x7ff, 0x4, 0x3, 0x7f, 0xc], 0x4000, 0x101}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d00, 0x0, 0x8}]}) mount$overlay(0x0, &(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080), 0x3201481, &(0x7f0000000540)={[{@redirect_dir_off}]}) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r3, 0x1, 0x74bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x26000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x800) (async, rerun: 64) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r3, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x1}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044880}, 0x1) (rerun: 64) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x29, 0xff, 0x5, 0x2, 0x21, @empty, @empty, 0x8000, 0x1, 0x100, 0x7}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: split chunks (needed=true): <9>, <9> bisect: split chunk #0 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 14, 16, 30, 30, 8, 15, 16, 30, 6, 14, 18] detailed listing: executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) setuid(0xee01) close(0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x0, 0x8, 0x0, 0x3}, 0x18, [0x5, 0x80, 0xfffffff0, 0x457, 0x2, 0x10, 0xffff, 0x7fffffff, 0x5, 0x8, 0xfffffffb, 0x5, 0x8235, 0x0, 0x1000, 0xd1c, 0x3, 0x9f5, 0x6, 0x2, 0x97, 0x3, 0x82c9, 0x9, 0x5, 0xfffffffc, 0x5, 0x1, 0x1, 0x2, 0x6, 0x3, 0x8, 0x7, 0xb, 0x101, 0x8, 0x6, 0x7e8, 0x0, 0x8c7, 0x190b, 0x3ff, 0x8, 0x4979, 0x16d2, 0x3764, 0x10000, 0x6, 0xb, 0xffffff83, 0x6, 0x6, 0x6, 0x7, 0x80, 0x1, 0x4, 0x44a, 0xffffffff, 0x6, 0x414, 0x1, 0x6], [0x80, 0x2, 0x2, 0x100, 0x9, 0x1, 0x400, 0x3, 0x7f, 0x8, 0x9, 0x5, 0xea, 0x1, 0x7, 0x9, 0x8, 0x80, 0x4a8e8b3f, 0x4, 0xa, 0x1ff, 0x5, 0x4, 0x7, 0x7fffffff, 0x4, 0x800, 0x40, 0xd1f0, 0x9, 0x6, 0x9, 0xf, 0x5, 0xf65b, 0x5, 0x6, 0x6, 0x6, 0xfffffff8, 0x2, 0x2, 0xe, 0x8, 0x8ea4, 0x5, 0x9, 0xd10a, 0xf506, 0x1, 0x2, 0x3, 0x5, 0x4, 0x4, 0x0, 0x3, 0x8, 0x3, 0xb, 0x4, 0x1000, 0x59e8], [0x5, 0xdb4, 0x70274e6d, 0x0, 0x3, 0x0, 0x6, 0x800, 0x47, 0x7, 0x5, 0x4, 0xb, 0x2, 0x7f, 0x3, 0xd, 0xff, 0x4, 0x9, 0x7, 0xff, 0x3, 0x1, 0xfcfbfc7, 0x2, 0x776f, 0xb, 0x6, 0x5, 0xffffffff, 0x5, 0x8bc3, 0x5, 0xd4, 0x3, 0x6, 0x2, 0x6, 0x8, 0x8000, 0x7, 0x7, 0x101, 0x3, 0x3, 0x1, 0x4, 0x7fffffff, 0x7ff, 0x7, 0x5, 0xd, 0x7, 0x5, 0x5, 0x9, 0x7, 0x2, 0x400, 0x1d, 0x2, 0xffff149c, 0x6], [0x80, 0x4, 0x800, 0x9, 0x4, 0x1ff, 0x8, 0xb8f2, 0xb, 0x1, 0x8, 0x6ea, 0x7, 0x8bc4, 0x94c, 0x10001, 0x1ff, 0x5, 0x334f, 0x8001, 0xfe000000, 0x9, 0x7, 0x5, 0x0, 0x8, 0x1, 0x3, 0x80000000, 0x6, 0x4, 0x1, 0x5, 0x9, 0x6e000000, 0x2, 0x2, 0x8, 0x6711, 0x9, 0x6, 0xfffffffc, 0x7, 0x10000, 0x101, 0x8, 0xfffffffa, 0xffff68d8, 0x80000000, 0x4, 0x80000000, 0x3, 0xea, 0xffffffff, 0x0, 0x4, 0x2, 0x5, 0xfffff468, 0x8, 0x2, 0x2, 0x3, 0xfffffffb]}, 0x45c) syslog(0x4, &(0x7f0000000640)=""/167, 0xa7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000100)="0f01cf0f01ca660f3881a1007066b9800000c00f326635010000000f30b800008ed8ba2100b039ee66b9490200000f32f4660f3817d00f01ca", 0x39}], 0x1, 0x31, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x6) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xfffe, 0xe57, @empty}, 0x1c) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000240)={0x60, 0x4000000, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x4, 0x0, 0x0, 0x8, 0x40, 0x15, 0x4d}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="836bb66f", 0x5ac, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x8f, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109027d0003010880000904000000010100000a240101801f00020102092403020003010008c80524050308090401000001020000090401010101020000082402010201090709050109600201060c0725010c01060009040200000102000009040201010102000009058209ff03db085e07250100061c00"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x72, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x2c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040010}, 0x80) (async) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x40001, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x16, &(0x7f00000000c0)=0x104, 0x4) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001"], 0xfdef) (async) r11 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r12 = dup(r11) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = dup(r6) ioctl$PTP_EXTTS_REQUEST2(r14, 0xc0603d06, &(0x7f0000000040)={0x200}) (async) ptrace(0x8, r0) syz_usb_connect$midi(0x3, 0x59, &(0x7f0000001f80)=ANY=[@ANYRES8=r1, @ANYBLOB="343fc0c99291f0869161e84d8093cf44530b4466b27115d9e455c1eda5a374dc44401c030880c1771d33b6e8aa0778cdd2f8fcf7965b1a32f22fb2438d72dec4b15a7e45f8b493fcd4fdda5387f782564ab394989dccbc19c0ccc09aff3004da794399fe7531052961ccff32d264d3c7df6f00b289efb737536ead23e4a13ab25e73accd417bb3455251da97bc4cbc76cc90b93bd3b2ca6e90bbfb8c6cc10f0fb877ba2d9f6cc9632beb95b6eb9bd3df9fea9c03e0811218f7ae", @ANYBLOB="28da9a2f1cc736a94ed3722124928652cfcdc4b1d31fffe1fe385b66843b381d607bec4f5d7439f3b64f1a22e05d762c36a5afc747ef25e42cc4609223e3145a411f6d3f507a11a6f1282f812cdb65764bc076df328eff96a90a8433804e86bd8b60d5f4b191ffa4a895c2f864971a13d3c7133ee5c5778760c4f2581bbd69226435115c8b49848bcbb75a799cbb3023a8de299e6261a55e5fc93b30d1d1c7ade71b663badab4c13b5463b522061d4f2142aeaf17ad66198c8bfe5a23dcf65b0f06e49ccb81643a0822ce8097795a786fd8c02a9f0ee4949d6bdbc8d00a4bf78093a788f870c825ba8bb70ac808295bcff1b58e0be77ce888b504df176d0be5c633907719dba3e670a70abf48878ddc24388307d56d25c9c884b52b917d0c1558393b89bad24614f14ac26eb2608239e39abaa0ba07b740c93411f4a00bf543ae240a40670f1c68bea0f3697efe211ed4e6c63bab529be5f7c9336763bd827646a57003c8c9f5d2c6bd99abdf1e3049a964bd9d5eaf94b22783c2e8302c665d7a74ad3eb9e8f0ca40ddc4a3d73125f6cd47307518dbf68a2850b6ec1abc90189456212695f2bf4364fe65b9d191e525a7c2b6e7280135dbe288e2b91140e067866f16e2a0e7ddee25a3fdd1959267a6d29be4141c8b0ac9ebab51f17bcbb231a65c23d5c2736e6fdddd292ba67542cb7fa60842c231fa94e17c27b3d6c1a81c6c0d9949c7abdecff8eb4b21af1a8a222302b18777150432e1e41c41aa1ac5c7efcf6e7a4292314d750ce9ea394af8c0e11fa5f4855e8f81319833ce2e6b374e4ad486421c6ce1be1d6f66d0ae0b7abf00dc1df8ea274d2489e0207e4a7fc243ac7e89b7f81ebd30d33efb55b09c12bf6312e08d45c8b815c64c6401ff92a006416839a374923ed0271935f0ee078f39b7c57121adac47439696d6e6d20886ca18b41b258cc9f6659cab48c9b9c10404c4abb4244f85fc19d41d319dceb9fdcdebb5220200380b70653eb8690282e21d9407a2f53f086053ea64c97f8d6c349dea23a1acc8b4d3b7756142fbcd3eddecbf98f61a0becd9446c71902648b2f0114d2609c31d870335f9553159c9e410d95f0abcb0f72dc55b4bf7357efe95758939179f7d18db4f0c65a064b3caf49325a0bfe9fd893736dea950d5c9e48532896498a89e655d844a0ce8a2fbd647c6f73ff062923999456a73124e8e3db9e140f2a15327c49e1dcdcb949f7905c84be68c2f766f252de885c5885a9cc2bcb17af8ae9c9b6f9bddb96088bb266281cc83910c08f3bb3bd30804490de5fce35b3d5db215e830ca1505f489f045e4f3175bb0deefc68828bfee3ed012bc874c374aaa44af7cee4558b2d77dc910bbfef3a732994270a1a4fa23042826e88568e06c9241365cee3fd2a121af0890b0a362f1d51aa8ba88cf4efc082c5d5da85d476232e0bf8c0cbb204e42c22b61b83de897e4040d21c45352e5cedc0e52aaba5ba74865ed5d98d51beaff39c8db11563c48251d2bbc0813a53aa7c7a1e08f7d263981c485bc70e79714bbc28c7c3f2750a22f6ceb6ad06ff265c634ac79bd7e642304d94a2a3e08594e45be43ed98c7ec1443a438ca3cc8d0ffb1e7e64983cb803bb5eaa9c901566b6d82bf7283d7cb8d929a9e9321f9ff1d0f519446e99199d01768274e25509cf9e0677b19bbe177926c196bbb000f7dee9ee614f83ac5a746c3ca4a86e7e54569831d2a25c348aa0baa6d8ad1f545a66b1f0f3b7fb8a35bf5351f6c4cb712e075213c4a1904f014a298221362d3f925736937f895ea99377d7ba5f04035748f24eba740f6072eac621c0de7050f0208d4f45b746ffa1bb5fbc45d06061d69cfd3c824773500e59cc7ffaeeb6b2c55f928f65fc8b9463745e4267bc6c9f470ebcb1a9bfab36f1f5d59e5d277de81994a3c03864bf8c53f2f389dc8392ff8e1d395ebbaf79e666dde57c32db18a4157f36395458b3d32830e41152be32141958bd546a026aba13e26f120ebafd822f0383504be687967191a44e23b433cf87f7e3929f804801d2158910017cab987bea6076d02a5f95775d2b8950d6c937f9e2d4bba33859e0e03119dc2e340b9ac05cdcb2f1b77c6e88ffa24f4490a263191136fcb97ca61e24a7fef9631286ff7f2f5e8896a3a2015f85b51f05a47fba39e0e3b67e3284e7aedb0832e4a95b6c85e246d53bbb9fd8d5355f70c50bd63f3546acbac7214951be91f6d2e5d9f86a7c253e2e7e04b6fca79c5f96a30d538495c38aa5aa5686969f9aa47c941148142c3bfe7c346e9485bcc66bf9cd681f3eb4cc9887ec5b1adb10317c72c91d56af45c44b964b7c95a3910c97590391b0f232663de62df1e564e98cf46762257af39553ac67d0e42072b1e645072f5715c490a975cf0d74ad4b88e69bc645f16ae1d6861e3ff6e948e4d9b958b95e961e4e79017f45d2b4693921f51e70c493626d0487f1cfd9219cf21c9934d43bd9d19bb02612b5dde8e0b9ea40d9cbf92dc2c2030be22b15feea3f38c1a8747cd8f4db094ece65ff483f6119d9ac76b6c05480b118cad118ceb63142224745d78d17d9c0db7b78a8dd17d46275f00649722b2a9a9bf79dae7e1dd3877ee447c9aaa56999837751f2209406fef2c6e2b7da3a9317edf91d2434b4302916715fdb9814a05d1f89b8f144cf067082e72cd83eb9105e421cdd3e335abc966fedc142297e2c4b4200cdddbfcca3fd5e8b9147b9437651c5f6a2e2b98649d948ce5c23cec4c102510555267b1b12678785a32ead402f593369ae34cc01003d7c6f774ad7f1f9fe10e4d9ef70d0aec1be368b94763b34ceaf3bd49e858892690606702ff7a77cc5c1db5bd143dbb0d48bac438e385c009f34775e9b647e514a8e8ffc7f2dfd4abae69e81ac5effbd55c1d2aaf0277170c66ac49f905fdeb6be4562fc4d80f84e6286d36d0a72af97625bff767ae228d7369c8d6c30244ca0d304c53496ecd6443cd097b119559c417b857748594faa2599f80c0ef59422f48cb412cb8636947473faa47850a91b620b3249560837049a82a4f5c473911ca43ccff3ad38af7dee570bfce3ff8884194d8d41d39b3a94fb528a707fd294bb743f5cf52e9e9b3ed939dc6aa1f9695025e47ec4636d6ce3f0fc00ce3ac4bb00d8d9d381520c4eebf4fcf1ba56094fa81132baee3895a08736be4aa63056841462ba5817391c44686d9b0c9569c583ea721e5e6d6995a9ea3dd07229ab40f2b58d971a93db9aa4fdedaa150384d348af0737e655d4edea0fd4d1d826956bf443d977ad7a30400f76ea7246af9654fa98ffabdcb52690b0edfdd65355ad8ea764cb3097303a504b7ed9fe49516b5410de36e0acd0bf6259aed94f1efcadaf0494d40224f9f3214e2bb373675e0c5734f63bcd382ac88cdbb7468d3eccbd4707da5e85537820e32011c575fe1c9da18b657f1a2cd63c1f63d917894fa8ab621c5b0b9732d50b7d41a42e7fc9db63a0679bba66053ec909d92e55c732fa8fd5ad997a3b55dda0fb820c400f86b8c07f94c2705ac0005991c55f4a3618cff989640b3f80207c316214ccd279bf1884ef232811c145ea5ff360bbba3292af78224bcdc4baedba91385a6bed8fd6c74f265c041d141cbdc289dad3562014c33851d449ed84a75e9facdee30ee4b6b216053ca20598ad380ea77c43459aad1a4d1cdc8c0206b14de51d382cb3bfb1af26f06a573857dcdbbe73ac4b1e0d75a7edd0d36129c570a94fec60a468c0eea0a80cafc1e996d5ceea1b92bff21d3706ee6b35eab4802f347849852a19cc60abd72ff69e3db985caf2030bf84762036a4dc2ed2b3883df616c28f6a715e82100c200ff5ed6900f7b2f5a27663d268bd8d1f8c25b276e78d1c5e39d4ea2506bab4a38f110a5ac85ace6d7001d8fe5044a2b519c38ff404d6e38080eb4b65633fccf810e7d59ccc2f3186bf70f1f5cea3eeb18ab97676db67488fa3139f4969d33a8e27271b1427e5028fd1b4b68ed5e108c0b2734ddf0966fc91074cfd048db6acc87f9e57ba873e0f3403315a2598ae6089b199f5d5dafe655530fe9df513016dfd1064fab61741ae28f0875fd25e85def18a6f7ee52ebb876627099f63411fa7a3580db990f1b44963afc347540e6830c9c4f88389710050ff9927d3138cdce5be9043596903656c5283682006c210e3a7e93c2cfd5e9bf1a3d82e4f690b36fbf5da0240ce5539ec4c6d7cff734e4cfafc695d461fb8a039c7d86dbdaa484972f05eefe286099415ea09ae4dbe01d29f252134f96f924a68f07e8c5928d01a2ecb6b71b522b168a8e9be2263e05fedf5eebdd19148ba2cd715a0f258ee8384dde52b465fe6dac627e6228870027902c09557becac07201e4cab0a5c5beea51e9020cd988e9ef0ef008e70bf06e818d5f4319239659b24a442070d068e61710ed52bc32b60a3470ed9b50eca1c7100a9392b9fca09981b05523dfaf504d3ed38844b1dc30c0b0fad415036c7ba0af7494c4f7f6d5f416ebbf1751e0a192bf3fd88483f5420e6cf1eac8b3dd717df521aea3775063b47dd1b74fd55ea41b21b48fea4d5cc19abb0a832c789a1f26c38a13f92bfcaea7c8ea38b256a3f90e6d48cdb5f887f6a36c9741e2e3d78f912ab730364f0a27e5894118ae3cbb3b03c8cf558e8f151091bc316aa9bff2f2796f74e64d9e2f09e328d83b28443f80e5f06c0e05e49b4aa2306d12899c04c4c19c10946a1addbd4773e71461bb0cbd86cd3db65fa66219932b307f64dc899416038d16f2c59ccd8dc0c28f80f43261539e5e75702aeec05288f3c0f3a172c62789f5d2781c32a981618d0080bef0361baa5a88bac9c500c87e944036e8862e363e47a43ab7ffbb4a27bd8bdb62006109675c4d04634fa16d22161fb248ac063a312fb98a2e79db2d0cc2571bc751c2847f631ebf1872067b062c0ab7d72520f2a0f0b61a59bc41e0464260ba3617fd50367b3d6bf6d58d906c025dd875ae0807769e1292be8c0167a3bd96db0ab6eb0c6e0065d08998633b5ae5a3ac166cb20d24ac673ecabc027f3dade542c80f5c0db05b6ac05feeed5f2d1524989543a2cf32eb6867532aaaf3526a24eae749bf1d1b1f00f349fd63b6db89c12e0ff8babf695c52e794afc1abed8430ede135b27430224882747abf8ef669bc4da36812c141944d2351cc277a7f500961f5fa5159ac57eafdce7c198457996323193f02bf1e6aefe069849582da635ef0dcbe4518881749a11440e9aa5927c672d7626ef286c69f5637f9a963a766469092a1921d5b2e8265ccd4840fadfa6da8087928e29f02f5c8abb90b983b5b5fda5737725fd6294567e68a8d02eb2a677426b1b89cd4db302562dcd9a47c1b29bfc91730b7374f129688009a6e699e865ab88c34e02e1cb3ed30fd5ce11d1225790aca77e3c1b486a49b8c46cd79b0da6ddce7262f87d45496bcfe86a64965c77b4c9e42001800a150ef49ce179a945d18b276ead9c45b554ffd71e2ed07f4380dd94b0c737ebeeae1fca5317ded582df0d0e3bf11e9267fe6a17e6de8672181f07d345e032d4f9a21ce9c7e67e781e99576babbfd6a40b1f5db8bb38d6b7c0b2e2fc6b5dfecd4ca96428327b0c349d83b8a70d44895af1a0f3de1ceaa7ce8a8caa548c60d50fc46ca34f85c22577869e80358d91c132da69e987665f59cbe8b2ca84e84c33d17bdcf8dbc818a2c8b924860856da0a77a640d67a1d4a4c066f5d98497bb2ff911efa3651439fbba9bdd626bcf4161e6f0d94110533d9730b0ba4da477ced060ed7c9d0fea7b1075da476c9ab5405b7c4a9ee2b8a74e4d1944a5b8ae2a935fecf0b171c5217f67dfad8348da2a2bdee860ad3dc2bba05e6a9b48312fe5edb59dff246f2", @ANYBLOB="4434cdbcc5f4778531d1"], &(0x7f0000003500)={0x0, 0x0, 0x0, 0x0}) executing program 0: syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYRESHEX=0x0, @ANYRESOCT], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NILFS_IOCTL_GET_CPSTAT(r1, 0x80186e83, &(0x7f0000000300)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000002000000600000008000300", @ANYRES32=r3, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040001}, 0x40801) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="5a53fe8e378bea61e8796d39bddde5ee79ed541be00f01305ec9ef082be00b20488edce2c5b4f11dc6f81445e4b349bff8bc6a5cb6cc98280a2844fc072193c4681477d7dda4c7c32f38c922f5d26aebc3aa03a3a69e705ddcad7af27ce8c90fa0f759a4a7c99aabe8b3ae6d0f38bca66b08c1f567ed57dd992c5831ce31186123d77d2a844c9ef3ee20f91b18185aab198fc5f4b40cd74692d0da807f67269bcc2c123e90999ba4f7b1d82c5e91b6061322ca4bbfcbf4ed897c4d972160aa307f8278a788125651cb6c0ee0a2d7fbbb62b6d763a9b5071f9e274e5f6871341123d8e6cdf528f3a762b1e00ac4d7897732f0dc29f4b7d7c041d5b48e4055e11b3d89506c685ac71643432e9dba15727157c3d6a5c2b6aabda6c9f6bb8e0827104d0000000000977b4424641e9c9dcf9d0b298563", @ANYRES16=0x0, @ANYRES64=r2, @ANYRES32=r3, @ANYBLOB="0c00118004000600040006000c00bd00ff7f0600010009000a00060008021100000000000600ed00a2020000280011800400070004000200040002000400010004000300040003000400010004000300040003000500c200090000000a0006000802110000000000"], 0x84}}, 0x800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x537d2ba428f33b01) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)=ANY=[@ANYRESDEC=r1], 0x18}, 0x1, 0x0, 0x0, 0x90}, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0xc0109428, &(0x7f0000000100)={0x1, 0x5c410c3c}) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x6d) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99925bd700000000000fc0000000000000000000000000000000a01010000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x40004) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x2520, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340), 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000240)="db2d82e6036cbb7e31105314a0fe5f5989bce02d44c1641ffc1cd7d99f6d010251ce2340064f5cac4f96a73d6983035797d24dd1d5f72084b2979a327b1631b445d3ca60d4a2d216cf6a20bf4c449b790b1cea906d2c8203173bb46f2d23ee787772e35c17223f0f1dfc8faab1a7e7d53b3f1839a3f9ec10e980f3c0e89e808b4641aacc977b69172e7ae9efb164c872a29124d879022a25237a", 0x9a}, {&(0x7f00000005c0)="6c43a715ebbd318addcd79db30fc82c7897cc1af4d30ef0c0793f7", 0x1b}], 0x2}}], 0x1, 0x24040015) r6 = socket(0x28, 0x801, 0x0) shutdown(r6, 0x3) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) readv(r0, 0x0, 0x0) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) getpgrp(0x0) executing program 2: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r9) syz_ublk_setup_queues(r7, r6, &(0x7f0000000700), &(0x7f0000000800), 0x1, &(0x7f0000000900)={0x2e, 0x0, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x0, 0xc0107520, 0x20}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000b00)) executing program 2: mkdir(&(0x7f0000000000)='./file0/../file0\x00', 0xa383bdae8a56c7c6) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r0) tkill(r0, 0x12) ptrace(0x4208, r0) tkill(r0, 0x12) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xe01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x3) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x400005, 0xd, 0x100000001, 0x646, 0x80000001ffffc, 0x5, 0x7, 0x8, 0x8, 0x8, 0x3, 0x7ff, 0x4, 0x3, 0x7f, 0xc], 0x4000, 0x101}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d00, 0x0, 0x8}]}) mount$overlay(0x0, &(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080), 0x3201481, &(0x7f0000000540)={[{@redirect_dir_off}]}) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r3, 0x1, 0x74bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x26000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x800) (async, rerun: 64) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r3, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x1}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044880}, 0x1) (rerun: 64) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x29, 0xff, 0x5, 0x2, 0x21, @empty, @empty, 0x8000, 0x1, 0x100, 0x7}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 14, 16, 30, 6, 14, 18] detailed listing: executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) setuid(0xee01) close(0x3) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x0, 0x8, 0x0, 0x3}, 0x18, [0x5, 0x80, 0xfffffff0, 0x457, 0x2, 0x10, 0xffff, 0x7fffffff, 0x5, 0x8, 0xfffffffb, 0x5, 0x8235, 0x0, 0x1000, 0xd1c, 0x3, 0x9f5, 0x6, 0x2, 0x97, 0x3, 0x82c9, 0x9, 0x5, 0xfffffffc, 0x5, 0x1, 0x1, 0x2, 0x6, 0x3, 0x8, 0x7, 0xb, 0x101, 0x8, 0x6, 0x7e8, 0x0, 0x8c7, 0x190b, 0x3ff, 0x8, 0x4979, 0x16d2, 0x3764, 0x10000, 0x6, 0xb, 0xffffff83, 0x6, 0x6, 0x6, 0x7, 0x80, 0x1, 0x4, 0x44a, 0xffffffff, 0x6, 0x414, 0x1, 0x6], [0x80, 0x2, 0x2, 0x100, 0x9, 0x1, 0x400, 0x3, 0x7f, 0x8, 0x9, 0x5, 0xea, 0x1, 0x7, 0x9, 0x8, 0x80, 0x4a8e8b3f, 0x4, 0xa, 0x1ff, 0x5, 0x4, 0x7, 0x7fffffff, 0x4, 0x800, 0x40, 0xd1f0, 0x9, 0x6, 0x9, 0xf, 0x5, 0xf65b, 0x5, 0x6, 0x6, 0x6, 0xfffffff8, 0x2, 0x2, 0xe, 0x8, 0x8ea4, 0x5, 0x9, 0xd10a, 0xf506, 0x1, 0x2, 0x3, 0x5, 0x4, 0x4, 0x0, 0x3, 0x8, 0x3, 0xb, 0x4, 0x1000, 0x59e8], [0x5, 0xdb4, 0x70274e6d, 0x0, 0x3, 0x0, 0x6, 0x800, 0x47, 0x7, 0x5, 0x4, 0xb, 0x2, 0x7f, 0x3, 0xd, 0xff, 0x4, 0x9, 0x7, 0xff, 0x3, 0x1, 0xfcfbfc7, 0x2, 0x776f, 0xb, 0x6, 0x5, 0xffffffff, 0x5, 0x8bc3, 0x5, 0xd4, 0x3, 0x6, 0x2, 0x6, 0x8, 0x8000, 0x7, 0x7, 0x101, 0x3, 0x3, 0x1, 0x4, 0x7fffffff, 0x7ff, 0x7, 0x5, 0xd, 0x7, 0x5, 0x5, 0x9, 0x7, 0x2, 0x400, 0x1d, 0x2, 0xffff149c, 0x6], [0x80, 0x4, 0x800, 0x9, 0x4, 0x1ff, 0x8, 0xb8f2, 0xb, 0x1, 0x8, 0x6ea, 0x7, 0x8bc4, 0x94c, 0x10001, 0x1ff, 0x5, 0x334f, 0x8001, 0xfe000000, 0x9, 0x7, 0x5, 0x0, 0x8, 0x1, 0x3, 0x80000000, 0x6, 0x4, 0x1, 0x5, 0x9, 0x6e000000, 0x2, 0x2, 0x8, 0x6711, 0x9, 0x6, 0xfffffffc, 0x7, 0x10000, 0x101, 0x8, 0xfffffffa, 0xffff68d8, 0x80000000, 0x4, 0x80000000, 0x3, 0xea, 0xffffffff, 0x0, 0x4, 0x2, 0x5, 0xfffff468, 0x8, 0x2, 0x2, 0x3, 0xfffffffb]}, 0x45c) syslog(0x4, &(0x7f0000000640)=""/167, 0xa7) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000100)="0f01cf0f01ca660f3881a1007066b9800000c00f326635010000000f30b800008ed8ba2100b039ee66b9490200000f32f4660f3817d00f01ca", 0x39}], 0x1, 0x31, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r4 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)) ioctl$TCSETA(r4, 0x5406, &(0x7f0000000200)={0xfffe, 0x81, 0x8, 0xb3, 0xb, "6c06002004dc17a8"}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x6) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x40, @remote, 0x1}, 0xfffffffffffffd53) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xfffe, 0xe57, @empty}, 0x1c) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000140)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000240)={0x60, 0x4000000, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x4, 0x0, 0x0, 0x8, 0x40, 0x15, 0x4d}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000000)="836bb66f", 0x5ac, 0x0, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x8f, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010002000000406b1d010140000102030109027d0003010880000904000000010100000a240101801f00020102092403020003010008c80524050308090401000001020000090401010101020000082402010201090709050109600201060c0725010c01060009040200000102000009040201010102000009058209ff03db085e07250100061c00"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <4>, <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 16, 30, 6, 14, 18] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) sendmsg$inet(r0, &(0x7f0000002040)={&(0x7f0000000b00)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="f7af0330783e09e884f6edafb4985f7a8b11b5367b77b7f27173010e2b3eea7b37a72babd8a2c351253a946e17d4d83990b201c2e2244c82b68a3caad67dfce213b9213c1741901b19075270597c0f161f7602fa1dbe26995fcb17baf0e4399cc6d874b003fe9392fd9012c9d28064230ab756fe77e6c42ab697f88ec538547f196873d72e5f7d662b9c0291c7c3be8ddedcc2e56936dfe8e88fbe27ef8defe8b9fac3ab8f826c81bff1f63d9e38ef31428b53529699075da5d125f42ccebac3c0896aa3b1e83e305318fede1452276170c5ed84294dae4babbb19f690b2c0c9", 0xe0}], 0x1, &(0x7f0000002000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x91}}], 0x18}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) (async, rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 64) sendmsg$AUDIT_USER(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="88000000ed03000225bd7000fedbea25964136dab969b551570200000003876b14ed3c208da58aeba1fef5f38d530d229c2b39d246d18e367f9812ccd221daa83da5678e8c90cea915d51c1035cb9b348bd4a0edf86df0cdf90a448fd070600ec97cff11d6e16158b75edc30661dca337e625be35a13000000"], 0x88}, 0x1, 0x0, 0x0, 0x40886}, 0x41) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000340)={'tunl0\x00', 0x0, 0x10, 0x8000, 0x20009, 0xa, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast1, @local}}}}) (async) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async, rerun: 64) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000088d864c51d2f3936cabbbbbbbbbbbb0180c2000009000000f454f6360086dd60d0228e00003300000000000000000000000000000000000000edffffffffff00000000000000005c6e504807a6862ce233a0a6f2bd89ae3c7de716fe4bfd0d2542a0f1282892477c341b4db151d26853bda9e5e38602d82c0346b9f354974778b1d0810000008a"], 0x3e) (async, rerun: 64) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}], 0x18}, 0x800) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000b40)={0x2b7, 0x1, 0x7f, 0x401, 0x2}, 0x14) mount$fuse(0x0, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000900), 0x800082, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303032302530302c7573d99c00651f3fcb48c761935fe17ee57660aa3eae073b46c91e4df31a941509a9baf49972a82095169604726ef0683554e6a179819fa7159f94899035d266", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions,blksize=0x0000000000000000,allow_other,default_permissions,default_permissions,blksize=0x0000000000000200,default_permissions,max_read=0x0000000000000004,\x00']) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000240)=@new_dev={0x2, 0xdd7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x8}}}, &(0x7f0000000380)=0x0) (async) r9 = socket(0x840000000002, 0x3, 0xff) shutdown(r9, 0x1) (async) sendmmsg$inet(r9, &(0x7f00000010c0)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000240)="a90500000000746400010053469a680000e5c064", 0x14}], 0x1}}], 0x1, 0x44884) r10 = syz_ublk_setup_io_uring(0x4d4b, &(0x7f0000000480)={0x0, 0xc86f, 0x8, 0x1, 0x390}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r11, 0x0) (async, rerun: 32) r12 = syz_io_uring_setup(0x42eb, &(0x7f0000000640)={0x0, 0xf4fc, 0x80, 0x0, 0x255}, &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)) (rerun: 32) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') (async) read$eventfd(r3, &(0x7f0000000380), 0x8) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, &(0x7f0000000a80), &(0x7f0000000ac0)=0x4) (async) syz_ublk_setup_queues(r3, r8, &(0x7f00000005c0)={0x0, 0x99c5, 0xc000, 0x0, 0x13e, 0x0, r10}, &(0x7f0000001c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc56, 0x400, 0x2, 0x289}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x978e, 0x8, 0x2, 0x23b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xda60, 0x20000, 0x0, 0x1e8, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd323, 0x200, 0x3, 0x1d7, 0x0, r12}}], 0x4, &(0x7f0000001b80)={0x2e, 0x11, 0x0, r13, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, '\x00', {0x3, 0x87, 0x0, &(0x7f0000000b80)=@buf_max_buf="2b4f54b2221e6ed2d880486b570a2b3f419965a85ed5f505a33d97253ae7c4e5307789a87c4e5b9abcd316b07061fbdd06893e7a366a0ae15a5a73d56eed9198c7c12ebf31386dc2461314e6456cb2f86ef1f1f2c045c417839c866579d3de58ecba33673a97210a5515947c518dcaeae5db15ec7b05eca675a3c90d89d6446c9dacd5464f9b76c6d6b534601ab0820e7f65311a2cc0cac0139386ae6cf4c6fec0240b66a6405eb23461ff99d0c9a2e14a4e7ffc1980a18783fb9ccae997f0ea835deb4b818d4346634c5e82b8f2b67e18543bba06be965398213e0bfbe51b6c1c8d7061e575dc9a404beccc265dc5935c8719a8091695115872104f7ce77195cf7dfd95578777333408f8b24ce1b2557e1157e68d2890525ec60aa3ff0183f91d51ee5791d50d8f457eb0d20b5e53c8a01d1cce400c315c2e688132916354e6e376d8521ddcfe4af61bb06d1fed4c9367e4775c49e3e0f083d27273514ecebc71d192f96d44372dc066181f13fd40cef40b4edcfac21c5fe5dd6152574e8b3c90ea494ca1c2f5b3a98a42a73fde1fa9f02216fc6fa8783e5ea8ec47892d45164893a94d749a455fe5c0c00dafabe662aea4d222920287c9d4090874eed75b3e5e2a36807fbca7ef96ea844087840f9865d080196ca444c7b779515fb8275d63a7b1ceb42d023f5f6f0025223df7f4e93e8980adc2f9a4af8b2753966cc066b23e26f22120befe8ddfb035bf16869aed1a0baaf71953e0f806fe37d30213b2728f9e578355452a7be426acbbb6f66d6a21b948388005dcaad1189c4bc4d7e98d2cf2efdb38d205a2d3ff5794a344bd5f67dca20d941289d6b9331c3b2c554078e2bc969a7bb7b5b970cb3dca7e7d8e0f56d77af1ce6349db6a578b5206d7e370467db4cb2a565cd832fb8ed1b3532b91c5ce6580b7aba34f0d1d5fb194d177e66a1fe24835dc6bbe51738f31b43c25b4073a86699339b2c9fb6c263ae18e03d31ce10b0db9b30dddde68855a01b9c1401a7316b2866b631c9260f80e17ccf0ad453a16d0b4e36b1b7decda6b0f3a36ddc8d8ccfa74f7c352f2f6ae921703f5b40d4af027ee21acd9118bc123600ea1b101be220ca1c24582887b7b1e5606711d4b06572b845d9a44446581efc6b992cac6ca585e41eb99c39c2231a8a0d2638af8921a2eae5d9f1df6bde5c3a9896b4514459bf8f1cde45d15e34fd47b15d98ddc6572f9940b45bedfb2e6691ddfabbf8a3aa224c20c0914807b6f3dcb0277ab61442e0cc6dcf28f591b2a97b15aa0848d624cf4d75cb28b40b42e1f3507390f089e21835cb5f69a6abe8b7f9fe164dfcbe27c2b2b16cdef90c4e6e08082f997869a33f3adca66722f138b3938215cf7de6bbe06d0d512f2bb40badca88df6522b63c0b7747b1f0da6d50738ec3675e0d05b3786782d21cac36a33649855507f7172264095ba57a813b3035e3dfd66a358e06c822976eb81e21900b0fbbb4d00db373fa1c949b1dc6c0dbc02a2659fd6edcc1fc4d0c92552bd95c43a17241d397c957f8660814b08c4c1456f9f95bba1137940dc27520c2b4549545183103baa6b0766bcb7ef5ac30e4aa2655a1502f499865c8c4d75044cbd1785e87cd0523a5de1bef86aed87ee3b2d362634396d9864aa7daf11a386c3a8f666ee6f9ae7cc767c3e84c7ddff858b9848d164f267a1ebaaabb595e58cafce87fab7d4df59479b627cf7e2e1d03dbbce8e645e0e924f6e008b0156f7a6d1cabb6592111b91a3759336e85c2cae45ee49126e2fd41fbb2190e3786318cb2d2a05869c09641de0ffb2a46d63e4eb733d529be8a0be0958b9f7dcba794884521539ede5ec41d1828564ee26353653cae967740269bdfc6774f2eac50d2c65443c641bd3cf9313e411049cd4a73ce4a33e9801d4754d02e6124990f37e23d33dfe72545c729549c9ec03a02ffed42b1db6066db56025c23d688e13087efc71e33f8a69f86ccb324dfaf0b2e0eae8b948b13e074ca20e9b1905b53f00e403b024106cd5d6f997c3652b7ed92b0cb1c07c818db91078dae0fb1212752f52ab3b1469da6cc4e63e8043065ea340c1dba46c61b4f01897809ee3813e863f04ecf550b82a0c5a66d5baf4949d0d51de4887ffedf55316ecb19f1e06c2880d450fb8eff91c69477569e4275a4213402d59b336ebb585267d6d43e8c27bddd08330d37c3823331c6a9a558ff2ecea8985e0bab366a07225064939b0ed436bbefb48290f0aa4441d90600f27cb35aa5e412c390c19449c070a4573e340498a1401c906a80d72fc9929c6cd7358388926aed5cbe7f002d1925ad838a2aa5885c9a5e9550e37b7b66871ad259d75a730dc512fd9def0fb8d0c5e0ca220191ab582aa0f3a77de76781e70bf4817ae843c9f812f0b74e555dc756cb539d7de6b5b017e19dc06c6d6df3d21b3844c0278ce2c1ead6f4a5f0b3fc6d9e93319ca62eaf1b6c5276183e79d6ce8e9bafcc44036f02c8bda317dee514194d36e1e9e114c1ff4650c2ff653e4c2b1d37e169b44474feb4495438742eece3adc0acfd106f7a926ba0881bde56d5905d7b4de4b3f73c0b2536d8e4bc688912bfdeac3907dee41812bb2856ecb33844098ecaf43232cc8ebaa8d17581c1374f1af1b30b8afad0d770c5a6312a0e1a56c28257395e5b6edf9ed3d43faa85a9d57331e876a34f2036e3228e020dee8bdd32b5bbe06997fbb00f9b33f76abb920256d1599905f6d3e08b77415430bcf5c9f72f0b424b5ee5cbf8eb2790fdf4aed6c73a55a613e78bac2556c0ae73ab24e0ab57e25da7e9a59d5aa36930d338b4062e3f1edda16804c299090aed4c904ac920c372d0a7d43d4d96f0ed99f8a343f7b8302c0b104401af4ddafeb9e52c54ad95839999d773c59d0b5e28ebcaf645c9d91cf9028107399fb2658fe1df306d50cba20102e7547b884ca266a36adfd04d9a4ba361cd27e77ada8a426b95721ef67e5f17e619dcfcd8a082b9f7ac1e22035e0b7f271cb3171d7a3998733c26389ded5d77672cbefdb662a43451997c65f13af11e8ee73b63a1dcc6975672ec5c537acc2107354be77e328e68e819303ee070cdb490172577b032908bde4bbc949803495e0ce3abeae6b42c48d59df13daa2125531feaecaf026c536bfec0b7974b33ae6fe93ea6427908e3c5d0db8cc0c274358297e604840422ab86e4ac49bfdee888166940bf2d27c026f81a961d563b8342c5148bf00ede414e7ec4f18a9a5ffc39bb145eea4c24a005195417ac732ff122f1705f879ba72acbca8649ced851022ded208f73d92476b70b80a5db9e0bf3fd4eb731967fd7eac2ca952d31ae6ee94a07f7753c3ab0388d921150a99b5c3d504908faebcc432963721f35f8493f4b3f75236b91b1db66de620c922909d65e8a5a97d6a7415956fac002b87f1cc36c88e5c276234688e8b5ab43cefbff1c22270538e629640a395ae5459b5184487f3bc1f6c2e3a4325904060d9f72fbaf99c654d907c4735bac5a5d72e3a857f03c885eb16b59cc3dd6309316847a8d0a8d1c1503386eed359b86f5d3bf5769f3883015fc2fd1c4839f66a2e1a04e4c16b032211c50249fb8af017b28d79be75d5a9e95107371cbf7c978df6cc9a051518a41efcf0bda96717b70a39d0f3c9d2e77e380a95a0514e64a93fc9dbf0dc4f68010fb8e889436623d81945810e094becf66ddf68b6ee406c8c85cb3487139669f1555283b76eb788b3747774db55720dfc6fa108cc078c7a1425f4d157bb2125c3442063aa5217430e6b0413d0f89c5886f9d41fc423f9e0bcdae2ae298ccb71f0ffaa2ea6dae11032b2140c5ddf26d7b4a0d1f05e2f2049ce3428163cd54d253ee62deb9e9f12e7be1774233c800e90d013d7197f57ad60fd0abf6ef599982f14b0745eccefb99047d8705f2e0ce07d6be234a5f1fed1fb4047f1f13fe47dac13cc03d11a781f7242b34ee9e34d65f600e4f04b84b0b43d4e7e7191a05360882bdae7ffd1274284b3567a02450eb94ffea3b1e755e439f5541418f19cfff01540a8b76bdee094791c188a8d77edcad8ea68a4c4db5cc0689259c3a65672c2801847b59e68a3d2555378d4e3dd2c125a04a29a41277ab8b7da49b5f13c0d55853d13749a81867a3936bc8991beddcc4303954c17a03c9a82b4c77561ccb1b7dc2c716ced86c1a1a50c662db5c90f7a5f116f76fef151dd6ae954c71ea613a2fcdb443080ad2362b781f027889ad0c9011c901de607bb557fcedee197b3dae6f6367990428d95ed1d0cfe364660c1cf61bd71d8d792347e44ebfc14601f1fcf02eebe71973b31a167a994a1a609846b71683338310c5e9eb0b3a38d45199e47025b4e746c92b96b79e325acab172056280e17f19c9c9505a58ee4bfc1aa15b68b104fd638d5283ef265b2500d673c3773179f6bb587271a8be34b328e723858cefafb2ea60dd6e6b08044e63c65cb486b696a4eecbb271f69e34a456ee9f344b778019257ea8e926fc11319a8ba0ef5d4be47a915ebcfeb247800987a6e0e46cd52bc7ed65b0660729cf948846b189dad490cda22dcc72e2d2ad89ab4c95f786cb464f32e6da9da91de60c8a37418219e6b7d4cfc873a9e76dc76c17f43bcf58d453df3c7391fff64ebd2f2b28f4f326def0b9854658676a9f7eead5fd32b32c06068a07eb17445b1f6ff09723f45f683a3c0afd0c75c7a709bd2abdd7b57aaa957961fd7d11e455cc827c6cac6272f17153367f4c4401a6984a394a145b04f6bd98275bd8c55264c7efe44edce8b93216d45f4c736a6237e3956a390f2e4e84b401a71852da7995d3e313516dbd72e59b2eb47b256c114352ef1d68790c5537346516a2014fdacd2c05d4c8a7da243435a2ae8e73c2484e684da04b5a8ab24357c75b287f68048083c038e0f6839e63035f68059331b6ff2cc5fa09ff62e99b6f5feab42c6ae1c81a6ffbc77e0dbb97d0e4fa51aa82560b4da935205b0c99e5eb2e017ce820273d5326607805c0ffff92292549304d3a1b32c6034be63462b5fde5bf81f15072c830f24a4766e4e8b4430d66692d08fde2e05be1daf86e241d2c8d3405cf42914fc60c35a45ad4558c63a757d2693279e133baabf79a4ad1e6691a675f589b15d2667bae9f46315110cddb15a08f20a9a1149935f630c9d8e81e0dfdd30f9d80ecd13dafdad155d55517f794c7de3cc584c00cc774fb423da8aa72758d96cc23af85bdb9ceea7e7ee618a37ed06b619a33ab77f1ff7a0342d54923062be0f7b17e998d5e76cf2e01f3bd4e82b3aae110b2c536f910048c107e12b649d8d301accef37b29b056b3e99022044eb666ae618ffcceb6da66b2592327fa1a690a93a9522c7f43c0d14a69e5ca65bf5039d6d26ecd5cbe1768ea2dd52b6a169af9a64463dad74e4a0d700f4756bb97ed4e64335565baad86dd6e7ba40a92305d33baa20bc8fce6292c8a781ad5015cfc89692a0f17222429e01a3d29e032e3cb645928c89e52d5c4ec9d71a0d712afadb7c005a55151519bd2096d571747d300b7d38bb911052059fa9032131418fb0a58d7448aaa0beb87904bf07ade79e501d9c29282074c6973d77e43befbd0f1b1c1a862bbf9bef7de29ef753c7e400f5795bdc662139fb6ded8233569b9987f8986433fa50403c66d951da2c5f56456d59e2486e4a5d89856dd8771abacc7216f44f444ffbe00d3a2ccbbfb2e0548a65ff6417b9d95d1876eb48ae68ed5c6889e3b42d211afcccaae5b938db1bd259e3eb84e67562ef63da49af75d3134936fa"}}, &(0x7f0000001c00)) executing program 2: r0 = syz_clone(0x2000100, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r2, &(0x7f0000000500)={@val={0x0, 0x18}, @val={0x3, 0x1, 0x3, 0x4, 0xc4, 0x10}, @ipv4=@gre={{0x5, 0x4, 0x0, 0x26, 0xd8, 0x68, 0x0, 0x4d, 0x2f, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x19, 0x0, [], "1c794c5fcd565649050022835ac3ac97cb9fb274d4d9998212"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x9, 0x2], "7fb5875c8cb1e5103810f3514c5859085f8bcd044121d872d527be9db6ccba47166b45027b4ebb9222f071ff96f3443ec4461c325c516f1698e1f011fa3bfab0dedf7bd62f68af"}, {0x1}, {0x8, 0x88be, 0x3, {{0xa, 0x1, 0x3, 0x3, 0x1, 0x2, 0x0, 0x4}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x9, 0x2, 0xe, 0x3, 0x1, 0x3, 0x7, 0x4c}, 0x2, {0x8, 0x8, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x3, "a33ce789860dc984c201b1e28a9fe3cd0d2bcc93a01e37ac14a0f11b"}}}}, 0xe6) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff01, 0x0) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 16, 14, 18] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x2, 0xffffffffffffffff, &(0x7f0000000080)) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8983, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0xa, 0x8914}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x195, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x5, 0x0, 0x4, '\x00', {0x5, 0x6, "3843da", 0x8, 0x73, 0xff, @dev={0xfe, 0x80, '\x00', 0x2e}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@routing={0x84, 0xa, 0x2, 0x6, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x6c, 0x2, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x2b}]}], "ed358ba529fce2385104332426935b752f6512f4361628f461ffcbb8f530a046428338e64915773b4cac7c9a8fa9217eed8c69722e5665ee5fb9f985c36e3dfb063716f23841aeb98c6a6edc51b65abc6d444f404ddbe7ba9716f128ccf17c011b1eaeac8b5a275633c04449748e6de0eba6c02f4a636c2fb0a1307794fe6cc51f06babfb63922624f1fe8211188272a89dad0057dae42e50ed961a24f096f4452aa93203469ba9d7d49460757800acde2fbbc966a26c25a14f7cfef50ecdd53ffc7b251f99074b311912cfe99fc6aa86417f647d4c9d0b064c9885a54535d862bfff895d238c4a3ca7501599d38209fa04a5651ad"}}}}}}}}, 0x1cf) executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 14, 18] detailed listing: executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 2: sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x10, 0x24, 0x6, 0x11, 0x0, 0x70bd27, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x4, {0x6, 0x33, 0xf0, 0x14, 0x0, 0x459, 0x0, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x5, @empty, 0x100}}]}, 0x88}}, 0x3d346b8a21f0aaf5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)={0x1, 0x29716cbe}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/80, &(0x7f0000000880)=""/91}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect(0x2, 0x43, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c0220000606030924"], 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 18] detailed listing: executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 3: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io(r0, &(0x7f00000004c0)={0x2c, &(0x7f0000000240)={0x40, 0x6, 0xbe, {0xbe, 0x9, "480f4aa05d8d9e3e1fb4c453e6dc5fa98a73fa82c93c33c699cfb43b00301ef8fc530b2c4c02531504c0320febdb2081c0acc79b1483ffed2754f180cefd949428f2975b182b1c21d7ed1123692ee431cd1f9b89589dde6e1b020b754d1ffa7411c1b6756a40b12510ef64e4dbaa11438543fdd909f8141e0d60389f2a322be01394dd1a319a982fa0fb85d558e0de9ea64caa315e19bfe3053a8732a7ac7c01c51f8dfb2dbf2083d48241cbec96641936e0d79b574ee5ec2b5c7d0c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}, &(0x7f0000000400)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x80, 0x0, 0x3}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x1, 0x1, "6bfe334b", "9fe9029e"}}, &(0x7f0000000480)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0x8, 0x9, 0x4, 0xec, 0x8c05}}}, &(0x7f0000000940)={0x84, &(0x7f0000000500)={0x20, 0xc, 0x5f, "29219b18a89ab5fc9188bb5f85055c73432078b70e9f8016f9faaaea09b180de5a908372f5cb1a32d16d1fd1025cd89f8025c1cb626d562b17328055ab2fc64443c24a9bf06942c85ba697d27f68cb590dce25c80e8548ed4228ea163f6758"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000640)={0x20, 0x0, 0x8, {0x40, 0x20, [0xf00f]}}, &(0x7f0000000680)={0x40, 0x7, 0x2, 0x6e46}, &(0x7f00000006c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000700)={0x40, 0xb, 0x2, "26b8"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x30}, &(0x7f0000000780)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000800)={0x40, 0x19, 0x2, "20a8"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x1c, 0x1}, &(0x7f00000008c0)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x21, 0x1, 0x6}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r4 = syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000c00)={0x14, &(0x7f0000000ac0)={0x0, 0x8, 0xdd, {0xdd, 0x5, "154033ea794e1dc544fc345006e24206f7644c56e2ecb7420b09c745aae2d230c429e32a3bef77be14773a83e8c903b56591101dcf69988fd0aeacaea0d4bdbe69c623f5c9ab2ee24288aa2ed30a81cd851bec31abe3df64d8e60506a6d8996c746eeca18e7acf2c0c7c8b3082c8b1b2f2991326b65c9346b8146b8ac58cb4c339e3c011a7a1b0e1294b03208a916eed42e8fbc170f24ed975604f24adabc3436d920745d793ddd80ba6e866aaf66b06e39e542f26adce71d30fbc11468c55c85c36f9a9e21d3ba7c88977233c6ce7bf01ff58ff2ebb262c865bee"}}, &(0x7f0000000bc0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000ec0)={0x44, &(0x7f0000000c40)={0x20, 0xe, 0xe8, "2917fbc2fd9a88b7dec1ebd3bc54d6be73983cc0a152f289669bd23e819494eea68220e46fa73047597add5fa006bb69a5655ef4d73ae6dcf366f2268321fa62b3f59707d2af69a0221ef37ac3a610f519e6c2329f0ee3539ac642e9877563528597745bf96fbf0a3180e0c2ca5fd9b2feb94118fe0731b5c2e44f1c285ad4c24c49594093784adea63edce50167c9ecf17b52944ba7524fb04c058fbc2f4d0fde5807923e34a563cb02a57af6f72586d018f30997c7915fb11d5c836c73b32cf383aff104aa080e7208d97b4da3c8db80c92b120076c2f8909ea223ed4fe9e1b4e9401488e7def8"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000dc0)={0x20, 0x80, 0x1c, {0x6, 0x8, 0x7ff, 0x9, 0x8, 0x4, 0xfffa, 0x9, 0x81, 0x2, 0x0, 0x2}}, &(0x7f0000000e00)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000e40)={0x20, 0x83, 0x2, 0x1}, 0xfffffffffffffffd, &(0x7f0000000e80)={0x20, 0x89, 0x2, 0x3}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0x7a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x10, 0x90, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "c0e4fec664"}, {0x5, 0x24, 0x0, 0xc}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0xc, 0x6, 0x2}, {0x6, 0x24, 0x1a, 0x8, 0xa}, [@network_terminal={0x7, 0x24, 0xa, 0x0, 0x1, 0x6, 0x11}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x4, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0xd, 0xd4, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x4, 0x6, 0x7}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x2, 0x4, 0x0, 0x20, 0xd8}, 0x10, &(0x7f0000000a00)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x28, 0xd7, 0xd, 0x4, 0x2}]}, 0x1, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0xc0c}}]}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 18] detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 18] detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) io_setup(0x4f, &(0x7f0000000000)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 18] detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 18] detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 18] detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 18] detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x0, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "3a7b9e5705b8"}, {0x5, 0x24, 0x0, 0x6}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x20}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x5}}}}}}}]}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 18] detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000500)={@val={0xa, 0xb3f0}, @void, @eth={@link_local, @local, @val={@void, {0x8100, 0x1, 0x1, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x234, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x3d}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x0, [@private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x8, 0xa, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}, @private2, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, @remote]}, @hopopts={0x3c, 0x1d, '\x00', [@generic={0x8, 0xd4, "f83121597351a10795edf9579a0b068d18ccc3c1a1e1230e548ee4fc362c111a42d4641749251bb6f86cb042840b88aaf0940cac9117ded23ce01ff3fe8382f916db80a0c7815935de692f08c1c6658e956b55ecd9d1009dd1d0967fae5948445320cbd9fa1748c48abf24f20de719ff99fb37aff6194f257dff878442aa628649c8f5438eb0febc6f122abaf10fb4ff023ed9c26f01cf6e3c2c7adbde378447ba82418ab4d0f9ffd7b9015d2019c04151c112a1e549114d994eb83e3014093302035518bf8eee01ffa53d952f5c4110cc948d1a"}, @hao={0xc9, 0x10, @remote}]}, @fragment={0x88, 0x0, 0xd5, 0x1, 0x0, 0x2, 0x67}, @srh={0xff, 0x6, 0x4, 0x3, 0x1f, 0x0, 0x1, [@remote, @local, @ipv4={'\x00', '\xff\xff', @loopback}]}, @routing={0x0, 0xc, 0x2, 0x7, 0x0, [@remote, @private2, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private0]}], @mlv2_query={0x82, 0x0, 0x0, 0x0, 0x40, @loopback, 0x7, 0x0, 0x6, 0x0, 0x1, [@loopback]}}}}}}}, 0x272) program crashed: WARNING in xfrm6_tunnel_net_exit minimized 16 calls -> 2 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 17] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) r5 = dup(r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregs(0xf, r6, 0x1005, 0xfffffffffffffffe) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 16] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) dup(r2) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$setregs(0xf, r5, 0x1005, 0xfffffffffffffffe) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 15] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) dup(r2) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) dup(r2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0xc058671e, &(0x7f00000000c0)) dup(r2) ptrace(0x10, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 14] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r3 = openat$incfs(r2, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0xc058671e, &(0x7f00000000c0)) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 13] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) openat$incfs(r2, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001a005f0214f9f407000904001f00000000030000000000000800040001", 0x21) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 12] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) openat$incfs(r2, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 11] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 10] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 10] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 9] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 9] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 9] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r1 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x40, 0x18, 0x2, "01f3"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 7] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x21b4, 0x81, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x22, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x3, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x77, 0x6, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 6] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) program crashed: WARNING in xfrm6_tunnel_net_exit minimized 18 calls -> 5 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-mkdir-mount$incfs-openat-syz_clone-ptrace detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) program crashed: WARNING in xfrm6_tunnel_net_exit bisect: concatenation succeeded found reproducer with 7 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-mkdir-mount$incfs-openat-syz_clone detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-mkdir-mount$incfs-openat detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8e) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-mkdir-mount$incfs detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x82, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-mkdir detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x65) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm detailed listing: executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm detailed listing: executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm program did not crash simplifying guilty program options testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm program did not crash testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program did not crash testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit extracting C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm program did not crash testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x4, 0x6, 0xffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) program crashed: WARNING in xfrm6_tunnel_net_exit validation run: crashed=true reproducing took 50m1.379947597s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341 Code: e8 81 fa d2 fc 4b 83 3c 3e 00 75 19 e8 b5 6e 7a fc 49 81 ff f8 07 00 00 74 1b e8 a7 6e 7a fc 49 83 c7 08 eb c9 e8 9c 6e 7a fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 RAX: ffffffff850d5504 RBX: ffff88811575ea80 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888115744588 RBP: ffffc900000d7bb0 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888115744000 R15: 0000000000000588 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8bb3ce80 CR3: 0000000102b9a000 CR4: 00000000003526b0 Call Trace: ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344 Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 60 6e 7a fc 49 81 ff f8 07 00 00 74 1b e8 52 6e 7a fc 49 83 c7 08 eb c5 e8 47 6e 7a fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 37 6e 7a fc 5b 41 5c 41 5e 41 RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 RAX: ffffffff850d5559 RBX: ffff888115744800 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888115744808 RBP: ffffc900000d7bb0 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888115744000 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8bb3ce80 CR3: 0000000102b9a000 CR4: 00000000003526b0 Call Trace: ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 13 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3216 Modules linked in: CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3216 Code: 3c 20 00 74 08 48 89 df e8 ef c6 ed fc 48 8b 3b e8 b7 ce d8 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 98 eb b7 00 cc e8 12 3b 95 fc <0f> 0b e9 b0 fd ff ff e8 06 3b 95 fc 0f 0b e9 18 fe ff ff e8 fa 3a RSP: 0018:ffffc900000d7b70 EFLAGS: 00010293 RAX: ffffffff84f2888e RBX: ffff88811575ea80 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888103653900 RBP: ffffc900000d7b98 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: 1ffffffff0fa8f78 R13: dffffc0000000000 R14: ffff88811575f680 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f44a3a72780 CR3: 00000000074aa000 CR4: 00000000003526b0 Call Trace: xfrm_net_exit+0x31/0x80 net/xfrm/xfrm_policy.c:4349 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 net/ipv6/xfrm6_tunnel.c:341 Code: e8 81 fa d2 fc 4b 83 3c 3e 00 75 19 e8 b5 6e 7a fc 49 81 ff f8 07 00 00 74 1b e8 a7 6e 7a fc 49 83 c7 08 eb c9 e8 9c 6e 7a fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 RAX: ffffffff850d5504 RBX: ffff88811575ea80 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888115744588 RBP: ffffc900000d7bb0 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888115744000 R15: 0000000000000588 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8bb3ce80 CR3: 0000000102b9a000 CR4: 00000000003526b0 Call Trace: ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 net/ipv6/xfrm6_tunnel.c:344 Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 60 6e 7a fc 49 81 ff f8 07 00 00 74 1b e8 52 6e 7a fc 49 83 c7 08 eb c5 e8 47 6e 7a fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 37 6e 7a fc 5b 41 5c 41 5e 41 RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 RAX: ffffffff850d5559 RBX: ffff888115744800 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888115744808 RBP: ffffc900000d7bb0 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888115744000 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8bb3ce80 CR3: 0000000102b9a000 CR4: 00000000003526b0 Call Trace: ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 13 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3216 Modules linked in: CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 d58365df94cd5f4886b4f3ec3f08a458f2157066 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:xfrm_state_fini+0x2be/0x310 net/xfrm/xfrm_state.c:3216 Code: 3c 20 00 74 08 48 89 df e8 ef c6 ed fc 48 8b 3b e8 b7 ce d8 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 98 eb b7 00 cc e8 12 3b 95 fc <0f> 0b e9 b0 fd ff ff e8 06 3b 95 fc 0f 0b e9 18 fe ff ff e8 fa 3a RSP: 0018:ffffc900000d7b70 EFLAGS: 00010293 RAX: ffffffff84f2888e RBX: ffff88811575ea80 RCX: ffff888103653900 RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888103653900 RBP: ffffc900000d7b98 R08: ffffffff87d49147 R09: 1ffffffff0fa9228 R10: dffffc0000000000 R11: fffffbfff0fa9229 R12: 1ffffffff0fa8f78 R13: dffffc0000000000 R14: ffff88811575f680 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f44a3a72780 CR3: 00000000074aa000 CR4: 00000000003526b0 Call Trace: xfrm_net_exit+0x31/0x80 net/xfrm/xfrm_policy.c:4349 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x6c0/0xc90 net/core/net_namespace.c:642 process_one_work kernel/workqueue.c:3261 [inline] process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3342 worker_thread+0xc51/0x1370 kernel/workqueue.c:3423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---[ end trace 0000000000000000 ]---