Extracting prog: 44m33.163225126s Minimizing prog: 13m1.004558361s Simplifying prog options: 0s Extracting C: 36.338388485s Simplifying C: 3m26.963952972s extracting reproducer from 59 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-prctl$PR_SET_VMA-openat-write-openat-write-landlock_create_ruleset-openat$dir-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-close-symlinkat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') program did not crash single: failed to extract reproducer bisect: bisecting 59 programs with base timeout 30s testing program (duration=44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8, 2, 6, 30, 3, 3, 2, 4, 24, 24, 3, 4, 4, 30, 3, 21, 13, 8, 22, 22, 29, 2, 29, 24, 30, 30, 30, 9, 7, 13, 10, 8, 5, 5, 22, 15, 3, 12, 24, 2, 29, 7, 5, 20, 3, 2, 9, 11, 13, 18, 30, 13, 4, 12, 15, 13, 2, 20] detailed listing: executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) syz_fuse_handle_req(r0, &(0x7f0000002180)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0x2000, &(0x7f0000004180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 0: mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003240)=@gettaction={0x28, 0x5a, 0x1, 0x70bd2c, 0x1, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x805}, 0x200004c0) write$uinput_user_dev(r0, &(0x7f000001c340)={'syz0\x00', {0xc, 0x1, 0x3, 0xffff}, 0x3c, [0x6169, 0xad, 0x6, 0x9, 0x0, 0x10001, 0xffffff1f, 0x1, 0x8, 0x2, 0x5, 0x5, 0x3, 0x24, 0x9, 0x3, 0x59, 0x0, 0x7, 0xffffff00, 0x4, 0xff, 0x78ea, 0x8, 0x3, 0x1, 0x80000000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x400, 0xffffffff, 0x4, 0x2, 0x8, 0x5, 0x5, 0x1, 0x0, 0x3124, 0x10, 0x4, 0x1, 0xfb, 0x7a, 0xc, 0x2, 0x3ff, 0xffffffff, 0x10001, 0x200000, 0xff, 0xe24, 0x8, 0x0, 0x40000000, 0x4, 0x78, 0xa, 0x9, 0x3, 0x6], [0x2, 0x1, 0xa000, 0x0, 0x9, 0x10001, 0x997f, 0x8, 0x80000001, 0x7, 0x22, 0x9, 0xb1, 0xfffffff8, 0x0, 0x8, 0x4fef, 0xffff25a3, 0x7ff, 0x9, 0x3, 0x9, 0x1, 0x7, 0xee1, 0x7, 0x8001, 0x5, 0x7, 0x2, 0x200, 0x8d, 0x0, 0xa, 0x6, 0xfffffffc, 0x9, 0xfffffff9, 0xfff, 0x8, 0xdf, 0x1f3c, 0x3, 0x2, 0x1, 0x1, 0xfffffffb, 0xbbad, 0x0, 0x10000, 0x4, 0x7, 0xfffffe01, 0xbfe, 0x7fff, 0x9, 0x9, 0x4, 0x5b58, 0x5, 0x10, 0x4, 0x6, 0x5], [0x8, 0x5, 0x7, 0x530b93b0, 0x1000, 0x2, 0x6, 0x1ff, 0x0, 0x2, 0x8001, 0x6, 0xf, 0x6, 0x1, 0x1, 0x9e24, 0x3, 0x1, 0x9, 0x8, 0x100, 0x9, 0x7f, 0x7, 0x2, 0x1d6, 0x3, 0x8, 0x3, 0x0, 0x3, 0x9, 0x6, 0x5, 0x80000000, 0x2546, 0x0, 0x0, 0x0, 0x1, 0xfe1d, 0xd9, 0x5d1a, 0x101, 0x10000, 0xb, 0x4c6, 0x5, 0x0, 0x2, 0x3, 0x40, 0x2, 0x1, 0x3, 0xd73, 0x10000, 0x1000, 0xf, 0x7, 0xfffffffa, 0x5, 0x5], [0x8, 0x7c7, 0x4, 0x8, 0xea, 0xffffff7f, 0xa08, 0x3, 0x10, 0x7, 0x0, 0x7f, 0x2, 0x3, 0x5, 0x5, 0x3ff, 0x3af9, 0xe9bf, 0x81, 0x37, 0x1, 0x3, 0x2, 0x8, 0x7ff, 0x5, 0x7, 0xff, 0x3, 0x15e1, 0x7, 0x5, 0x0, 0x9, 0x6, 0x7, 0xdc, 0x0, 0x8, 0xc, 0x60, 0xb, 0x6, 0x81, 0x70, 0x2d79, 0x4, 0x6, 0x8001, 0xb, 0x0, 0x9, 0x5, 0x2, 0x6, 0x800, 0x4, 0x8, 0x9, 0x7, 0x2, 0x2, 0x5]}, 0x45c) r2 = signalfd(r0, &(0x7f0000000000)={[0x1000000000]}, 0x8) accept$inet(r2, &(0x7f0000000040)={0x2, 0x0, @private}, &(0x7f0000000080)=0x10) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x1f00, 0x8, 0x2, {0x2, @sliced={0x0, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x3]}}}) executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x10) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x50, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x7}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) executing program 0: ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001540)='./binderfs2/custom0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000001580)=[@increfs, @dead_binder_done, @exit_looper], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000004c0)={0x73622a85, 0x1800, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000007c0)={@fd, @ptr={0x70742a85, 0x0, &(0x7f00000006c0)=""/231, 0xe7, 0x0, 0x7}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000840)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000001680)=0x3) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_timeval(r7, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r7, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r7, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x10, @local, 0xffff7fff}, 0x1c, &(0x7f0000000140)}}], 0x1, 0x404c804) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x624001, 0x125) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r8, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x7, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x4}, 0x94) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x605, 0xfffffffc, 0x83, {0x0, 0x0, 0x0, 0x0, 0x1001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x8100, 0x0, 0x2004d808}, 0x4050) executing program 32: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x605, 0xfffffffc, 0x83, {0x0, 0x0, 0x0, 0x0, 0x1001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x8100, 0x0, 0x2004d808}, 0x4050) executing program 3: r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x0, 0x8, 0x2, {0x2, @sliced={0xfdfd, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x3]}}}) executing program 3: ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000140)={0x2, 0x0, [{0x3, 0x1, 0x0, 0x0, @msi={0x0, 0x3, 0x1, 0x2}}, {0x3, 0x1, 0x0, 0x0, @msi={0x1, 0x2, 0x0, 0x7}}]}) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$LOOP_CONFIGURE(r0, 0xc0c0128e, &(0x7f0000000140)={0xffffffffffffffff, 0x1ff, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000f0ffff00", "2809e8dbe10859894822800800000000000097bdb22d0000b420a1a83c5240f45f819e01177d94f98dd4992861acdfffffff160000000400002000", "0000000000000000113ddb2802e7234f00000000ddff00", [0x100000000, 0x82]}}) executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={0x0, 0x0, 0xffffffffffffffff}) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, 0x0, r2, 0x0, 0x274) (async) ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO(r1, 0xc0106440, &(0x7f0000000200)={0x2, 0x36, &(0x7f0000000140)}) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (rerun: 32) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=@ipv6_deladdr={0x2c, 0x15, 0x1, 0x70bd26, 0x25dfdbfe, {0xa, 0xa9, 0x20, 0xc8}, [@IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0xe}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80d5}, 0x10) fremovexattr(r5, &(0x7f0000000480)=@random={'system.', '\x00'}) r7 = socket$inet6(0xa, 0x3, 0x5) ioctl$sock_SIOCADDRT(r7, 0x890b, &(0x7f00000003c0)={0x0, @hci={0x1f, 0x2, 0x2}, @nl=@proc={0x10, 0x0, 0x25dfdbfd, 0x1000}, @nl=@unspec, 0x7, 0x0, 0x0, 0x0, 0x4, &(0x7f00000002c0)='lo\x00', 0x6, 0x1ff}) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x3, 0x9, 0x0, 0x7fff}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_DELETE(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20004000) (async) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) (async) sendmmsg(r7, &(0x7f0000000500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x40000007, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[], 0x108}}], 0x2, 0xc040) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[0x0, 0x0], &(0x7f00000001c0), 0x0, 0x2, 0x0, 0x0, r10}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000300)={0x1, 0x1, &(0x7f0000000180)=[r10], &(0x7f00000000c0)=[0x2], &(0x7f0000000240)=[r11, r11], &(0x7f0000000040), 0x0, 0xffffffffffffffff}) executing program 3: keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) dup3(r0, r1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r2, 0x1, 0xfffffffe, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x1}, @val={0x8}, @val={0xc, 0x99, {0x5, 0x80}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000001}, 0xc8c0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x15e, &(0x7f0000000700)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x128, 0x3a, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@srh={0x62, 0x2, 0x4, 0x1, 0x4, 0x48, 0x8, [@private2]}, @srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@ipv4={'\x00', '\xff\xff', @remote}]}, @srh={0x2f}, @dstopts={0x0, 0x16, '\x00', [@enc_lim={0x4, 0x1, 0x1}, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x38, {0x0, 0xc, 0x2, 0x4, [0x1, 0x8001, 0x5, 0x4, 0xe398, 0x7f]}}, @generic={0xfb, 0x35, "9d720c2cecaf014125eec3bd2a94337060d894550f6e6514400e09a9f17e3c0bc4e5d3167c1bb73a973803e24c5fca4f850df3b83b"}, @calipso={0x7, 0x30, {0x0, 0xa, 0x2a, 0x9, [0x129f, 0xfffffffffffffff7, 0xffff, 0x0, 0xfffffffffffffff8]}}]}]}}}}}}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@mcast2, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xd, 0x0, 0x4000000000006, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0x0, 0x32}, 0xa, @in6=@empty, 0x6, 0x1, 0x2}]}]}, 0xfc}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "14d718", 0x14, 0x6, 0x0, @local, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xfffe, 0x0, 0x1001}}}}}}}, 0x0) r6 = fsopen(&(0x7f0000000140)='omfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r8 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x80000) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x8, 0x4, 0x1ffe00, 0x80, 0x1d}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="cf042b7d9200fedbdf251200000008000300", @ANYRES32=r7, @ANYBLOB="0a000600ffffffffffff000014008100050002007f0000000500010003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x1) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x3c, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7f}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x3}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) (fail_nth: 6) executing program 33: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x3c, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7f}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x3}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) (fail_nth: 6) executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x8, 0x600180) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000080)={0x14, 0x3c, &(0x7f0000000040)="43094f8c3494ccf4a8019a937151991adbc8c0653b6aac1b4fc9805165b325195d5541b398259ecdd87971027528f05e25daa40d106fb8d51c15e53f"}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x101000) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000180)={0x0, 0x7b, &(0x7f0000000100)="cb31e13836119038ac95e6377f3503f252ee718fff1004af4d808018a1a5474fde32a5e383b152dc14c4a3a0b3f882d377a993771e51a61032ef83528e4c3e130a9a212492cf9e3a01df90b07141a21debfcfa1cce05f7764491730145a3db28a28a34e32fd1570af5acf5382c0d3e6018b5d8788be301b1eecdca"}) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000) r2 = syz_open_dev$audion(&(0x7f00000001c0), 0x583c, 0x48040) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000200)) write$P9_RVERSION(r2, &(0x7f0000000240)={0x15, 0x65, 0xffff, 0x885, 0x8, '9P2000.u'}, 0x15) write$char_usb(r2, &(0x7f0000000280)="a76457e60571a9282c20f2e1dd7b74d685b7f2039419df1e2f6337248a4b39302216703f54dd4e2a4d1a27f4606bcd04e6ac25c4fe12c0dbff2494bd3a657820e05f40655e472c77a9b8cc0f5950993dae6fc2b6be7f1ddd1300f1d56518f69bf87cdaefaee4b4258530add9ee759be05896bb37ee1477a3afd34082451e549e692f34a7a24f0dfb8838c403e17f5ad082ec7e9c12b4b5b26190d3da93e51446e235b0df1b71539b6ebda263b3a24fab818fe5731b812cbb8c903251b26aaefa14", 0xc1) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x48000, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_mmap}, {@afid={'afid', 0x3d, 0x5}}, {@access_client}, {@privport}], [{@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@measure}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/input/event#\x00'}}, {@obj_role={'obj_role', 0x3d, '9P2000.u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '['}}, {@seclabel}, {@flag='ro'}]}}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r3, 0x10, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IE={0xc, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x8085) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000680)=""/135) fsetxattr$security_evm(r2, &(0x7f0000000740), &(0x7f0000000780)=@ng={0x4, 0x11, "b748a89bec329693c52d8257a445f33a"}, 0x12, 0x0) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000007c0), 0x400000, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r2) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000900)={'ip_vti0\x00', &(0x7f0000000880)={'ip_vti0\x00', 0x0, 0x8, 0x40, 0x8, 0x4, {{0xb, 0x4, 0x2, 0x2a, 0x2c, 0x68, 0x0, 0x1, 0x29, 0x0, @broadcast, @empty, {[@ssrr={0x89, 0x17, 0x1e, [@multicast2, @private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @remote]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000940)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r5, &(0x7f0000000a80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x98, r6, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r9 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/bsg/1:0:0:0\x00', 0x1, 0x0) ioctl$SG_SET_DEBUG(r9, 0x227e, &(0x7f0000000b00)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000b40)={0x2, 0x1ff, 0x204, 0x100, 0x6, 0x9, 0x3c2, 0x9, 0x0}, &(0x7f0000000b80)=0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000bc0)={r10, 0x42, "df674b75de33ab324159e87e3c8b9826b1f7cfbc5bf242f4593d4488fcb16ac1394baf7faa1c701823dc06ba5d460eab589ba4e6b24cb2d89d24d3606dcf78932b39"}, &(0x7f0000000c40)=0x4a) file_setattr(r2, &(0x7f0000000c80)='./file1\x00', &(0x7f0000000cc0)={0x0, 0x5, 0x4, 0x8, 0x7}, 0x18, 0x100) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000d00)={0xffffffffffffffff}) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000002200)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000021c0)={&(0x7f0000000dc0)={0x13f4, 0x14, 0x800, 0xa, 0x25dfdbfe, {0xa, 0x3}, [@INET_DIAG_REQ_BYTECODE={0x101, 0x1, "f35ee609395aa7aeaced46c16a68d148abb9f051bab7f672b8509fe52bfa44a6a61808729b0c17ffc230517cf7c4f99aebeca39b3f194b045d4996bf1441c4beb6f4d7606d631e1489bde15e9c4deee5619a3d77859bebc0ef1d5931e9090a98a7a6b665efa5cfc56c52687c1bd6e50f958b63318fefe4fc82daa9d18f8eab475b7b653f8bfbe89354b2731be4a51ec5a2016d63e9d7b1216f27fc904aa394d3c6fcbf87e9432dfb6e2f93c5e233a74cc5ae5a56fce3af8f4c645f824e29d2e0bece474a38a94efffe580b0d29f611c8c4e0a7468997e44724efef4fc37652348d94cbcff2635bfa5ffe0ee9459aa27fc64b52613addb2ca911087e02b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "cb6ac092ccb90ead4f963c1f180c648b2d37a7dda46782009f6a6f88145913b426a27d680cb051c8d29ac98badf6b61ad1bcd7437d85711e75e9f1a21db93b0dc37d275d2bc6d4e580ac07a9a28556bec2cb3f3a1c975e5d9165f4700bdfc8f08a8431647df9300413a67c4f8f9986c50b3447cd13e453b56848336a2d6d3e8f1c50f75ac2562ee9f85468fd6cef880706d5c05fd9062f3bbb406e0993eab47e90cb6d0d21852f603f6fb2ee09b2faa7f1c8422bac38fac8ba76d90364a7b7f14fb03a27378cfece20bb9ad8528adb3e5f6d14b0085d4567b665c59bf87a11927fe4ae6b45b4f467827bfd6b49fa60b01aa16cf6d3f8bb053c8770a662680838bcd933f4f60da985784bedb8b1f49e8c081ff73f74c61b10241cdbe78335daf920d965587ab1888acc58c6580e691ecd6136737a2a0ecbd062807910372fd6d94082d72e4f429ccc3129f82812aa76f9d3adaee36065bbe022cf48059c006c60f71c73ede709de1fc8f9363d1bc4cf1aaa427ba41cce9816300deb22f5a7a1f960184b46904435cfad2c42cd561911d9ce359bfbb70beceefe391826b461c6e97569f3d5e997e88ed8082f536b2e272c042bb72efc3fde604a487a4a96b0685f9797980898fea076e4905ce898ef0ae9803e9436a91235cf5daf67e133ceef1bc95a56a704bbd0604c5c848b3efae7747b5796cfdb6cb184b2260fd13146bae79a5dcf6865038b80e7702ebc6b11c35e349f88c3405b6d2bd3a11ece767f3be8c4b26df73dcdd2283a1b2da3ab63dd2182b8bdad7d69a1d84e43aafae6a235edbfc5926dda291cb515fd22f8d7838238141d34a2c060ca7cf7f6b9e5ce38b64264943f7a9c6e130a765fef6111018b99979ff91754690a7d8a37814a972f79f6bc28aa88546e966bb0f9989819acc273b5385bc8cc0262aab99ecf60869227d457f692c7c18cf16d9b06e2bbac0b1f89b4b4a3106c48f579f3cc793a32331eb2b0368f34272d43f107c69709e31d757393de65acecebb409bf17fa8956d67e27397899578cd8fc2d23c6acd4d1bcd5f5f18aba2fae34f68ba0ba661875f279783fe864b7550acdf0f4641418832beeabafdd887ba05fcc45f6c17392642202130f6fc6bf4f3f298ee76e7a705852be9a56d86275548234888e00b7261dbdf55c063024026172d124534caef4f44653508f2cbb6666952e593c85a38461dfbb3e1147122bb069e543c8e5ae6bd96dc4bf615bd3b341b77f372751467297ecfaac72fcf874c9ddf4d6d550908fb4b5fcdb2d2fa3d596203ef9eb2a09d0c8f08502f58d67ab0b68ce93d3b1c7e20afc8bfa8105d9f32d7d6c143ce30b7ebb186b17a527a28a1a4b67bd73290a95ff024dc9f42cdaac02bf4474fef2e88db18516d68cdf25f5f021bb613601e551a368b04d5cd473516279c6fa673cec603598a54a5fe55fa4c796c2cf94d00dd1469d1e7da3f61761f6336b18386eaeaac9eb8b854348e5207a41d6b0d553a90b816f0b8351a4a570d2850e873d4e50ad3f486d87f5ac80673124e280e5128cf520053171b39c00ff6f13f7844a621de03aae2eeead5e94216af11616c96b420e95253ef0dd9a0a53861d94b9e5e6b325ea15558871ce52108013dfba5354f5f2d5740e7c6430aa76de6ab5431a804b7632eaa2bca0c09d7efeb3d653f60d22e0534b2899202a2f270bd6e5c58a8d97961ac13eef8ec17f76624087e3732b451d7f46b102b79f3ff7f425c8f2f5f574a1c479f90af19fb42f1a982bf56d978b023973f9cc0fe7a8f2f752cc74ff05616be3ca3c0744ef9b35dd54e6610049f7986b552159ff02f5ccecbd10b59c0d0b4005654fcfb4332a3e8e3a2573ded07892c83e5f1f64a8f4d20c2e4a95c8d0dc00e2009645fbeafb3248ceb3314de922216a153e5e12afdc2e9b27b0833a4b2b01e7997d715a1854550a3d03ebe85e7ba10b285addcb36da348036370dd73cfda63198384d5fa45a5a92afac7b275f570c77a9b0ab60d444a692b59c6dba0a7b12afcbd014ad88320be8b08f098fc8743fbd863a31e85c2603142c0d12d8999284c00f893ae13255e090f019adaa39f97103de80a04b6174c12ee178ae35b99ddc097af224ffaf1408d4e8fb9e4285852857c054273a95744a4f5892161f776854f2bf76ef597693b45bc6e6a025c6e76c686fc4be0d1ee2c8b24a6823450cc8b2b1d76dc781a18d1017547a83dea6a20a43532e44fb8ee02dfed2ae2465c75d2a18de14ebfe8a9ee4f4c7908097ad227f68924ef2196f3c5eac0ec81a6d3a4a58ba0f5f9e437254a3c55df64453481c729f06172168717a4b8976553c5a9609448c97ae9e26b057547557e70c6081487f153d1c89f105142cdfa037e9ca770d9755e530a558e03c75ca7535818046009b18e13c84b1ad88a21fdf34d96bada9aeeeeb74e8907c7d90f52a43d77d1aa827a9feff67d5ec86dbfe25a9fe945d5ee3865866f26e9d72f5d40d9bcb032aab735118f65754a926f2738a2b151e8dfcb713f97cf4e7d81372fe25ac88244257bb9f1b599619899e9e8a408b702ebd5c012da75f537f8d9444083a2edb4e8a2948f962d92467c0998235e0467078524866843c5d20e3b0bdfac629c71cbbf0ca969e11aa23d3a77c9637c03b8f85f919064aa59a92e2b5a419b39370c96465d3b6aedc695fa1393e4060d51392525e8822d7eed5cb5593af0886aee9340cd329d182ecb612471a826382bfecafdd3c822b80ab821774ed385dfa93d284d3ec9977ac93434255340fd79d7af970ccac48e7359652979d060393df23cb1c37e74eb4d749c93f1e6ab1fec72c371b147bc1d9c0e14c5f0c2f47188aaaa1d15dec6ad68c3604c6c7b34405ab707b56d67e3d5b3e222da3e086b50ea30293bbde93cdba3e4d2b65500ddb289f0b388522b6c618cb29553bc96e692f8fa4ee36aa272e5fdfae47aab5f44ec22680e96495ec6733c2ec87d9d47bc96d6a317f89f5fe7b9f27d96498b658fb0d535840e7932445bc561400049a665bd75c1d6161566d6581750f63a8b0c47d57641bb6b5d52c18848d1ba3ea012f4a5694db59f139f469cb750633d15a35c0aedb34d24ffc6afd41b097d7b59ce6ff772b1240845d00bcebbece9e9b87b14be46bc2ad40bf1e4554860c3287b4a9d7d53594bf4cb8e91ee7ed4cb8ba0817518d09355f26b3412cdb4c85e8f0f075be2655ae39979d5cfad616dc6b3e65215b27b9c2936b486b83bfbbbddc5ca703290e7ae1f2fc9cd61a563c7ba7de516929d4eed7dbff688742bca6b235bce2ce9ed152e3e2b6a0cade7017cb912a275049675439a38294080bb4b846a1b64827e923d0c14cec8e4160b84bb944db82fa6e3df896479e17f2b68e99a4cd4b70c9caf93300e16429eae0e4d7afab198d3804e518e88e8f1fb36f9328d462e2354509869192f70540ff7511e767400bab9ab18037da4bd244815bee08d3261781173086d7a3508e40c6009c535abbab5c187c363767a2c67d76060690586180502bcafe78db8c11a592d5f330f06bd3c0f3e938ab482711ab410bf5d6c3180d4db820d73cf2696cf9dc13aec703972f0b73d941e6425e17d31f887a8299f4e02b9d7e55ba8c476758e2e22f53ff003190b7dbc7897451bea8e4be4fed8e1344e555fc09f7b9f413e6b63c190670f2542693cc65fd89fef73161a49e52632a9e596e69d412f50a016efedf98ebbd0d686a8c2d95934c17236bcc9c9fda785d2462380912408b512531e5adf4dcc5091e594cf16a056b85031bef03ab0e2dea7587f767938a061e38b64d134e41707f18d6840730077af68df2a73337fe6e40148675071cb1b66441d0c02183c76c6bdc6f7c2583df188ae3b2858257b1545e5611b7f0d95498c9f933e3f87b15f3011145ce822f1a2e91623ebd17620ed4db6c020b4a7e14043a6006150d81fb099473430e66fc0c0f4266d6f71ec3469fb934160aea045426c6bb17900a464921347b917782ea1868cc06859d36693b8587b5db688c115b49c00aa8c6ccac9ca5491c5c36e3053e57dfa7551291889fee60e3cae5ba221437209b542c38ba7abda28fbfb5962296a661536cf1bd9b55c819b46c939aa8768648b4f98523d81b8157ae8d8b0cf7e91c8ab9ac73a153a71281ebecf71d444de82125cef9601a769f5712c6d15fbccc2d89b241c102cc95e326c740c0a7d8f2546785ce52607ef0424ac30ff5b200b2f8547b34864fba2794b8dca63a755883c07db4ce926959065c6eec8e169d08c1e327e8ada276215078d636564f5514c11134d161b4cffeca4edf8606b38b81595fd77fe2610316542221158b73943e9f5d9d822cd793711d024a154c9241226bf7ed44321d979a9faaa185a65c75fac5a47972995a906659a65848a9c5a13759835a6c4cb4bca36fb5b396d47d0e1ff8a8c4d98468c1598c371e6b57a326a164724ef4badca7ba536e9ece2d3d0a50afdd0db9354e20119a56faaa6b475b241cc844f199b7d510672ec63c04899404b0de2f7170e88da7c39966a87fb95d1bcd4bdf53867297b27da13db1812fa571b2d72ef8b02059ee89a24b91536d553b240a77d3526af13bf74d66acfb1907f28b031e8660e17a2b7f31b3112898a47bc308c498a4d13e7887f1d2f6e4f6a9270ee01bde35c1f1b891d091acbb5e7f5d8eb89f267895ebcd6d0a6366fb0ecf3d38bda1a73f04e5ca83c0fe9092b0f673572a415007af2e44c67c585bcd3d6c96bb34f120272a99ad8ea0bce654298b90295707b830b1bd9e3b34135a53f444b53c94e460825a35b8ad0428f6a53b791a2e3a0e9bd0a32b08f8456b347642a87bc82b2e6585c522f0db88ea2f45af2723b87be493566cb85c96220cd512f858b76dddd2edb7666371b6b04a2373e78fd35c9086858402712c96247d318d3adb7152eee7337fbe2d12702031fc6717523b17132a9ae96ebbafb6a356b825ee15ccc16dbe705975430cbd4ffcf4370810f10f16bdcaf90234213e011da00945dcf163e52e929204ecb417de0498c743b2765498925da0388d869bb897d16d623771b1f63e6d79d814dc0fb7cd735bae0f81368c39d52e8ebe0c5f3b9ca5ca08087a34d4de0fe3710935a13469e7716b452e79e31c9ec39d4cea2664d71336aa3e4ca25e28696cffb088ed1abb1a0edf759d151313c7c285708adace19b369397a1978ccbc3b736414490a425bb8c7b8641372b56f61821c60c19a7d0e918bbbaaedc832ee7deee6d31102ef6ab59bb430b23ac7491fa17409d3266a471fa08107877b21690aed465bfd64b48fd4d4b4db3fe3a0e3a20f267981810eee5e3a7268011925cc60e90a7f5606b04dc2ff80123194065e58282e86aa3b838c017ecc0dc1cf3f882db387aaf8bba4a99c596660aa3d4239b4042ab66a55559086c86cb4644d8390437efa261728e749ea3fc39d5b7b28c990d86b140b2a7664c88c63a19a85541399b6a9ba3e3d134dc53d6e83cc83f86d82e121e99027742a4ddd1b93540e95c15260b555ddbab7119271b507cc054185a1fe58cd1d925180b729dd1cae5bb6bb53cba750f34ad95eac6360add144b91dc4eaa2a8dbc6639e28f5334e1f4864d6968c1cc9ee62576463ba164bd444cfeb1e2eac850e46154abda9df696d471e28cb79d62cb6d74e61ec5a199c35c28abc3aad184e5343cfe806167c2fa36b12056867321755096b3d330e6295217dfdb922cca1661678128660bb5837800e67f316be8ca03d5b85a6ffe90d9f695255c40c2f25b4401c38d636"}, @INET_DIAG_REQ_BYTECODE={0x28, 0x1, "76b873323c268a8652f79e1aa8cc77781d7ab239a9dcba7f9f6ed8548f5ec8399923061b"}, @INET_DIAG_REQ_BYTECODE={0x9f, 0x1, "d19d54b0b1431f0c9cebcbf83f5ab3560b1a60e6b2b18aff87ced6016f2c0cf2918f92e8eca1f2618aee3cf19651887ff5a926b8c343aefe7a1234ddd560c4dc65385f533b948ce9e289b4b02fe77e28b46bdbe1a622c90035f3d84a0f2f4a10943a62c70265029934d806ef53396a9a0df863ed326d38581dde347228022f589c1f7d7f815ae5eb51ea600784f101cb26d53214027fc5309ec261"}, @INET_DIAG_REQ_BYTECODE={0xc2, 0x1, "7b90a259da738884c7f4b2d218fcc9efb8505d536b7ba7099fb36905e3c82114eb0a72485886948ac75fc7a7a2a44681f0951a8bbc60b1538b2318f4ac0daaebb274bb537cc786dfecb3be3478e58c6a061cc1f144d806853290b08d07429eeeeb8624642791c1518cc5b354e728e968de5e23ef3971d39446e3869de9f70dbc6cc49e28eb668f2a3d382b5600b2d55f46f4df6b7ce5705bb00564d8df3cc7429204a1e18dd386698e1e5e543929513f07d2e5a74e2e42939dc8f1c47dac"}, @INET_DIAG_REQ_BYTECODE={0xde, 0x1, "14a5aa221f8400be3a7d282b278e705cc4b7634f89b6c0a664ccdc4f14c5692eb70e37b0eafcc7c3a9b95836b9ced8363caeb193a2ddabe0e39d652bd4a777ce1f43b0d2479e27bd34c77de30c9bd9062f70ffa54db65609377cb7e03a8d952d3f89a9548eaef97f4fa072017e5851917024006ab77e3616098fff601e2658a448f60ec9a1de66e7ddb224271a56dfcd59e42eb8f641bd2a72acf3efff2799bfab66a5a7ec4809c21368fdf7266b958b583d504df2ca2138fbe711f70748b079b346a1f84887ffbf7320ce42941f5dc29fa3d9c16764c2b2a8f7"}, @INET_DIAG_REQ_BYTECODE={0x5c, 0x1, "88f697aa058dbfe4784e141cd2f1cddb7ab0daa1e15f7985bfd5faee93b78428c75bca2e5e96084c78d3b8d6f71dea0f65142c79f820f32cca2c0eb7bd0f7a124f2542518b7b4c122fe3c18576cd89acddb58849e5c8d127"}, @INET_DIAG_REQ_BYTECODE={0x10, 0x1, "096cc226913a47530d935e0c"}]}, 0x13f4}, 0x1, 0x0, 0x0, 0x4040004}, 0x24004001) r12 = semget$private(0x0, 0x1, 0x20) semctl$GETZCNT(r12, 0x3, 0xf, &(0x7f0000002240)=""/149) semctl$GETALL(r12, 0x0, 0xd, &(0x7f0000002300)=""/246) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x95ff, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 2: socket$nl_audit(0x10, 0x3, 0x9) (async) r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003400)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003400)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r2) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r2) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000006bc0)={0x0, 0x0, &(0x7f0000006b80)={&(0x7f0000006a40)={0x38, r3, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_AUTH_PROTOCOL={0x5, 0x8, 0xf4}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x24000800) syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x30e}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) (async) r4 = syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x30e}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r4, 0xb, &(0x7f0000000b00), 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r5, &(0x7f0000000280)={0x2, 0x4e22, @broadcast}, 0x10) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r4, 0xc, 0x0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000000)={@val={0x0, 0x88f7}, @void, @eth={@random="e21debcc1332", @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, {0x1, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffff5865}}}}}}}, 0x3e) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000124d5240e316e9f958000000000109021b00010000000009047800018fa68d000905", @ANYRES16], 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x2, 0x123141) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(r4, 0x2e6f, 0x8555, 0x2, 0x0, 0x0) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='qnx4\x00', 0x208004, 0x0) (async) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='qnx4\x00', 0x208004, 0x0) executing program 2: r0 = openat$ndctl0(0xffffffffffffff9c, &(0x7f00000001c0), 0x121000, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x0) write$uinput_user_dev(r1, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xc559, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x8, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000000, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0xffffffff, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x200000005c832, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0xa0, 0x4) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40086602, &(0x7f0000000000)) symlinkat(&(0x7f0000000200)='./file0/file0\x00', r2, &(0x7f0000000240)='./file0\x00') ioctl$UI_DEV_CREATE(r1, 0x5501) close_range(r0, r1, 0x0) executing program 2: prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x50000}]}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000001180)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000a00000000008000f0fffeffe809005300fff5dd00000010000100070c10000000000000000000", 0x58}], 0x1) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000080)) executing program 2: r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x7, 0x0, &(0x7f00000000c0)) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x49, 0x1, 0x2, 0x0, {0xa, 0x0, 0x6e80}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="28000094a6c72421ae2000a4fc5caa69d05da9f19bc49befa4632f25942fb4ee", @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25080000000400068008000300010000000500050080000000"], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x20040800) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r5, r4, 0x1c, 0x3, 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5f0, 0x2f0, 0x2f0, 0xe0, 0x3e0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x420103, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) executing program 34: r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x7, 0x0, &(0x7f00000000c0)) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x49, 0x1, 0x2, 0x0, {0xa, 0x0, 0x6e80}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="28000094a6c72421ae2000a4fc5caa69d05da9f19bc49befa4632f25942fb4ee", @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25080000000400068008000300010000000500050080000000"], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x20040800) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r5, r4, 0x1c, 0x3, 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5f0, 0x2f0, 0x2f0, 0xe0, 0x3e0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x420103, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x6558000000000000}, 0x0) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000080)='|') ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000500)="d7") ioctl$sock_bt_hci(r2, 0x400448e7, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x4000) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newlink={0x44, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x7fff}]}}}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r9 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000380)) r10 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x60, r5, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x2a}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r9}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r10}, @NL80211_ATTR_NETNS_FD={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x20004001) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000000)={0x42b9bd9b, 0x0, @qam={0x3, 0x6, 0xf}}) recvfrom$phonet(r3, &(0x7f0000000100)=""/124, 0x7c, 0x2, &(0x7f00000001c0)={0x23, 0x8d, 0x1, 0x3}, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000180)={0x38, r1, 0x1, 0xffffffff, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x811}, 0x8880) executing program 5: mkdir(&(0x7f0000000000)='mysys\x00', 0x15f) mount(0x0, &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @empty, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x73, 0x0, @private, @broadcast}, {0x0, 0x0, 0x8}}}}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mysys/module/loop/parameters/max_loop\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) fstat(r1, &(0x7f0000000240)) read(r0, &(0x7f0000000500), 0x64) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000080)={'veth0_macvtap\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x48) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r4, &(0x7f00000020c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000118f715b6458ace4b0000000000000000000000000a3c000000120a090001000000000000ed0200fffd0900020073797a3100000000080005400000001d0900010073793a30000000400800034000000003140000001100010000000000"], 0x64}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) unshare(0x2a020480) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0xa0, 0x0, &(0x7f0000000300)="b44c806748f06309624431ed3373010001000000008c6390009c4ebd873094563683b7ee0fae7a6a53200386ce51def6a4effb9de8b4645c2b9c0614907dac12c6d34a8266e6124b925240080cd4f4e5b5da601596c31f137d2ce6ca74fd87f90ea0be786fe13ac0805807dd6853458eccc84575e9af5fee935d3bc54f9bdf5cf073b5a597a9df9cb422ce2ab5ff0700000000000093b110a54f32ad69d05a80", 0x0, 0x405, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r8 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) ioctl$FIBMAP(r8, 0x1, &(0x7f0000000040)=0x85) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r10 = syz_pidfd_open(r9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000440)=ANY=[@ANYRES32=r2, @ANYRESHEX=r6, @ANYRESDEC=r2, @ANYRES32, @ANYRESHEX=r2, @ANYRES16=r4, @ANYRESHEX=r5], &(0x7f0000000340)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$EXT4_IOC_MIGRATE(r10, 0xff07) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6f9b475dc3dec0012100001400a0c0c00bdad446b9bbc7a46e4988285dcdf12f21308f868fe3a4ffa81f9219a1e18c488e827c1bbec677217bde85a10182478a2", 0x89}], 0x1}, 0x0) executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 35: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) futex(0x0, 0xc, 0x0, 0x0, 0x0, 0xc5fffffd) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @mcast1, 0xffffffff}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x4000000, 0x4000002, 0x2}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r1, 0xc01064c7, &(0x7f0000000200)={0x2, 0x0, &(0x7f00000001c0)=[0x0, 0x0]}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000061000000000000006926000000000000bf67000000000000150600000fff07e03406000043fe0000070600000ee60000bf050000000000003d6500000000000065070000020000e3260700004c0000001f75000000000000bf5400000000000007040000f0fff8ffad350100000000009500000000000000050000000000000095000000000000001c0a7900009d3c2792138e042ce31c2b7ae994a5642cb064ecd5615f3196e3359aceb768637e60bd5d2e4b5992de991371274fdff6e79fc722e25659a7c85615c1b88bc894123cfe3614e887ffffff7f381ef4932cb0dcebea6d90e9c1677fbefd35893d883a2c559b7a34db461b197baf8ebb7c11a8df40d92706d0bbcc5bf6fec345ae9606c3c1a348f9b395592c1f9ae5de8923b27a6fdc20441018e5e4b41b13000c94df1f2db24c67d4c7ba9ec035883e2791a9e9dff3e8bfc7d1be00000082018f5f4b2c00000000000000387a601e3a3412086dee84efd375f0645f3301f55d3b9efdfbed9b430bcf0418e100bdff1c8bcfc0c229874bc3d2418bab997c8bef9aa55841caa572ddff9220c67c9e17bee524c3dc747445763ecb0a7f2cd12bc34b0fc6273786b5bba17e9b8f1c2af8e23c411a4d1124cfb5279195f701000000f77c71294bbfd85878726c49eb89085967722d98cb884d1afe82f7f722e38397996271700241094d272dd8b754b2dd7817450bc7921dd372e621dd447b86e7ffd1bdc198deb495cac0995ca3ef6c1affb693ae366b0f11db6e312bdb8261d0dc10cac6a27e29f171b8e9f172c3db24558d77b8bf18be45c50b3fc005fa7b134dfc948f6015e0389d7f34cb9c02cf517c8ed7a9b6159c1446ef1c2ccff2bde95aa860ed9b836d6b8fcab7663d9bd8415e6f90fdb007b8f3e009000000000000002eb85073720c1df1147c9f5013c82fc98604bd70cd56609a6b73943748a90002d9cf81bcb1d262845762f6b0a284cc463b42492bab0f7b25895cc3ba8bf0b5e0fc018463d03a73fa85429725545128b0e9b550a13d0dd35092250bbce4f618cad2375a34c7f15c3096f3e9004468cf1aba4a6f22ed0eb3681c6963205eefc072ab79ad8b126500419e25a94ce13a7a96deac79c90b8df10b1e364cf97eaa49fd2294320fad0d814f230f954eec844f6b658ee04eb1c6d655a3383928d6e0307a7097b0a5fa5040958d2b7ad0eb7605a7de7ce9cf0e6b472d764976fbf7edd83dac8b9273976bfd6090de0a73cf8a9b2c23500a4054703e2df18d8498356e3c1cd6418e149f8a22e95da26221d8a69b642915471f4917571357aa9df385c0532d6e70263ec616f88dc8f93c886ede7743c53d738b9c7021f0032970eabd2808c53128b3eb600f2614256184c506454980e542ce450029aa6de147a8c81e6f701a4b9b278b08e4b02710907923f0797f96413054f2d1b5f2ba0c49567b53db5d862acf2c42faa37c4a8738f64ed7fef9ffba58a3c1ca52b55aef071e4f11334e3a70918e5b18dab84decde74d616b5b05c96378acc79375a7ebdb54b01d512de48184950f5cac97f0a6dcc6d12c48c6e3b925fee7974ca8f3009188bbecc30e1adbc290ac99555ec069636a8079f8ca80343ff84e896dda2d4148f982feff6b38699fb57aab5596479f84b59daa9a406c5119761d5aabb51c5175461f8b0aa7265c380317f08775d8a8a8bda64ada2c6b3599f548d6272937e4d89ef6ebcecf84fa856024b55dd057056bbae005f0fba858f3abdd9c115064000000000000000000070b0bb28fd1eca97a90864863235d415379d1bdb3d35015f85be2ae802455d3b079f12aa837996ca1ce7280cb394b4c13ca623c30b19887d41eab495f698284a1bc17ff100000000000000000000dac089bdf7984e3300000000"], &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8}, 0x94) executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240), &(0x7f0000000100)=@v1={0x2, "79eb"}, 0x3, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x10) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x401, 0x800000, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x7}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) executing program 4: creat(&(0x7f0000000300)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x83, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x4, 0xe9, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000001, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x54000, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000500000028000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000004"], 0x50) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='hugetlbfs\x00', 0xc00, 0x0) executing program 4: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) flistxattr(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x800) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0x7f) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000140)=""/210) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 36: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) executing program 6: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 7: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe00000000f0ffff08000f00fd000000", 0x24) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc400000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180050001"], 0xa4}}, 0x40) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x2e3}]}) syz_clone(0x8003011, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fanotify_init(0x10, 0x2) r2 = syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$TIOCEXCL(r4, 0x540c) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) fanotify_init(0x10, 0x2) (async) syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') (async) socket$inet6(0xa, 0x2, 0x0) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) (async) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) (async) ioctl$TIOCEXCL(r4, 0x540c) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') (async) read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) (async) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) (async) executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x0, 0x9eff}, 0x0) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc601}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="034886dd09032800050030000300600000000228290081e949b93897bc3b0000000000007d01ff020000002900000000000000000001"], 0xfdef) executing program 7: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2008c040}, 0x0) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100800112010002000000400000f0ffff0000000001", 0x1f) executing program 7: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000007c0)={0x28, 0x6, r3, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000000c0)={0x28, 0x3, r4, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000080)}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='60\x00', 0x3) close(r6) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80c, 0x20}) executing program 8: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0xffb0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 6: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000013005f0214f9f407000982001f000000fe0000000000000008000f00fd00f000", 0x24) executing program 8: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x2a, 0x8, 0x4, 0x7, 0x7, 0xc0, 0x1, 0x3, 0x5, 0xdf, [0x80, 0x0, 0x32, 0x7, 0x0, 0xa0, 0x10, 0x5]}}) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001000010001000000ffdbdf2100000000", @ANYRES32=r2, @ANYBLOB="850b010000ffc300140003006d6163736563300000000000000000000a000100aa"], 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) executing program 6: r0 = socket(0x10, 0x3, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000000c0), 0x86000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000001200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000000ec0)={0x2cc, r2, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf01}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7c}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x656}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe5ed}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvtap0\x00'}}]}, @TIPC_NLA_NODE={0x1a4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "fdc9dc06e28d69bd7edd2dc083c591a9ea5271c3c274fb0a9ae5a55efb2e72ac3d80"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "25c45a06a150c8204ae4564dd31169897814c462cc0b81ed213e75166ad104ef0e8a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xee, 0x3, "4e05286ac28fa059c97f9a2d8857dc9cd84534c3dd67a0b8d84a0cefdd9da4e2dff552a79af512322c324d504a86e040b7acd2469b63e7b076a96995fc756d6fb3bc2654bcf6ca6020170a4abbbb1a96fa27e21db92ee172e488e6d6ad8666b9aa919017ffdb562e63700e1597fe979fb1aaca8dc03644462a50b5d9a6b60f94c20617e9864be4e92e4d7c26d7f53b26be108d9a0bcaaec4fefa88d8cb426cfe4591bd9883a84b60002cf107425a10f5bf9494044f88156f4ebf66aa6da151e18df6dca672681411d8886f490d7ad2050fcff8f749ce9047306e780dd3ddcfef23f1a8d1fa4d30ce5b08"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x2cc}}, 0x40010) ioctl$CDROMSTOP(r1, 0x5307) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sysvipc/msg\x00', 0x0, 0x0) ioctl$CDROMREADMODE1(r1, 0x530d, &(0x7f0000000440)={0x7e, 0x5, 0x3, 0x4, 0x9, 0x2}) mmap$IORING_OFF_SQ_RING(0x0, 0x3000, 0x1, 0x12, r3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYRESHEX=r3], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getnexthop={0x24, 0x6a, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4014}, 0x8040) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x20040000) executing program 8: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 6: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204441, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x4, 0x1c, [0x86, 0xc6fb, 0x2, 0x8, 0xffff, 0x8001, 0xd2b]}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x8, 0xd, 0x2}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x0, 0x10, 0x28, @loopback, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0x8, 0x0, 0x5}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x254, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xd0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x602}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '))\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '+:#]:^{,\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd990}, @ETHTOOL_A_BITSET_VALUE={0x52, 0x4, "c48c3b1ecd83ae6d926c4e769605e38ed11362a73088aae43386621cd8fb5dbc6f316de974d19b5bb20512ea350fd0765e53e19ce71d8e3a3ab5c50b07b2a9e61479fd97c3e95196386e868d7bc6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_VALUE={0x96, 0x4, "fb4a3dac77735041db4a035116940b893348c64261d6055424fe137ad91fa6cf0a91ef9764f29e1bb72dad61a4a09080892b20764f819901b14de30f3fb7ca40f67ad0bd2e5fd1c37d86c79e1acea352091ee6aa97e45479884397d21203e1be44c61d122c64127d801c25d27cdc01bf18d65145d9967e4b1ebffddb9fb02b48db2046a76c4480820f20dbf61d702796a017"}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\\\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000005c0)) write$cgroup_subtree(r0, &(0x7f0000000600)={[{0x2b, 'rdma'}, {0x3b, 'cpu'}]}, 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x6c, r5, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1a7, 0x16}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x10}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x4]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x9f5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x200}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x38}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x4000) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000800)=0x1, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f0000000840)={'syztnl0\x00', r3, 0x10, 0x7800, 0x8, 0x1, {{0x12, 0x4, 0x2, 0x6, 0x48, 0x64, 0x0, 0xfc, 0x29, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x24, 0xf8, 0x0, 0x3, [0x1, 0xca91, 0xff, 0x2, 0x4, 0x0, 0x400, 0x6]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x4, 0x79, 0x3, 0x9}, @end, @ra={0x94, 0x4, 0x1}]}}}}}) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000900)=0x983b, &(0x7f0000000940)=0x2) r7 = accept4$bt_l2cap(r0, &(0x7f0000000980), &(0x7f00000009c0)=0xe, 0x80000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000a00)={0x2, 'veth1\x00', {0x9}, 0x9}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) ioctl$UI_GET_SYSNAME(r8, 0x8040552c, &(0x7f0000000a80)) getsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r9, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bind$inet(r8, &(0x7f0000000c40)={0x2, 0x4e20, @remote}, 0x10) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0xac, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8014}, 0x20000800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000e00)={0xe, 0x14, [0x8d84, 0x9, 0xffffffff, 0xd, 0x10]}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) r10 = openat$null(0xffffffffffffff9c, &(0x7f0000000ec0), 0x204000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r10, 0x84, 0x1b, &(0x7f0000000f00)={0x0, 0xe4, "2d49b43fa2f1f5a74c17301b9d137a34e4c10785ad2bec3b418fa72d97855a3557ec3ee64e1fb1c338d9b5fd8442b178ce668aaf4be20897c72f4b583f632f46df5edcd13db4147c0515467335ec03507055863a7344c795f827eb0b0c523638bc51e132ed7859ef4781474d082b672728077947409363ce2394cc9e0b83c4ac95fee850d3f0d43c56664b51b2672dbd46095514e55e661efc962d5fca6b9507fe35611facb9eb03525f81e16dbbe075631510314ab2c4ee6fbedccb5cf04e33704f0c66027730106ea743551469b286d0cd9625596a9df2ade1f34fe2913305d12688f2"}, &(0x7f0000001000)=0xec) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f0000001180)={&(0x7f0000001040), 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x4}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x7}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8095}, 0x2004c085) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 16) executing program 6: unshare(0x60040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000300000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-prctl$PR_SET_VMA-openat-write-openat-write-landlock_create_ruleset-openat$dir-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-close-symlinkat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') program did not crash single: failed to extract reproducer bisect: bisecting 59 programs with base timeout 1m40s testing program (duration=1m54s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8, 2, 6, 30, 3, 3, 2, 4, 24, 24, 3, 4, 4, 30, 3, 21, 13, 8, 22, 22, 29, 2, 29, 24, 30, 30, 30, 9, 7, 13, 10, 8, 5, 5, 22, 15, 3, 12, 24, 2, 29, 7, 5, 20, 3, 2, 9, 11, 13, 18, 30, 13, 4, 12, 15, 13, 2, 20] detailed listing: executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) syz_fuse_handle_req(r0, &(0x7f0000002180)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0x2000, &(0x7f0000004180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 0: mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003240)=@gettaction={0x28, 0x5a, 0x1, 0x70bd2c, 0x1, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x805}, 0x200004c0) write$uinput_user_dev(r0, &(0x7f000001c340)={'syz0\x00', {0xc, 0x1, 0x3, 0xffff}, 0x3c, [0x6169, 0xad, 0x6, 0x9, 0x0, 0x10001, 0xffffff1f, 0x1, 0x8, 0x2, 0x5, 0x5, 0x3, 0x24, 0x9, 0x3, 0x59, 0x0, 0x7, 0xffffff00, 0x4, 0xff, 0x78ea, 0x8, 0x3, 0x1, 0x80000000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x400, 0xffffffff, 0x4, 0x2, 0x8, 0x5, 0x5, 0x1, 0x0, 0x3124, 0x10, 0x4, 0x1, 0xfb, 0x7a, 0xc, 0x2, 0x3ff, 0xffffffff, 0x10001, 0x200000, 0xff, 0xe24, 0x8, 0x0, 0x40000000, 0x4, 0x78, 0xa, 0x9, 0x3, 0x6], [0x2, 0x1, 0xa000, 0x0, 0x9, 0x10001, 0x997f, 0x8, 0x80000001, 0x7, 0x22, 0x9, 0xb1, 0xfffffff8, 0x0, 0x8, 0x4fef, 0xffff25a3, 0x7ff, 0x9, 0x3, 0x9, 0x1, 0x7, 0xee1, 0x7, 0x8001, 0x5, 0x7, 0x2, 0x200, 0x8d, 0x0, 0xa, 0x6, 0xfffffffc, 0x9, 0xfffffff9, 0xfff, 0x8, 0xdf, 0x1f3c, 0x3, 0x2, 0x1, 0x1, 0xfffffffb, 0xbbad, 0x0, 0x10000, 0x4, 0x7, 0xfffffe01, 0xbfe, 0x7fff, 0x9, 0x9, 0x4, 0x5b58, 0x5, 0x10, 0x4, 0x6, 0x5], [0x8, 0x5, 0x7, 0x530b93b0, 0x1000, 0x2, 0x6, 0x1ff, 0x0, 0x2, 0x8001, 0x6, 0xf, 0x6, 0x1, 0x1, 0x9e24, 0x3, 0x1, 0x9, 0x8, 0x100, 0x9, 0x7f, 0x7, 0x2, 0x1d6, 0x3, 0x8, 0x3, 0x0, 0x3, 0x9, 0x6, 0x5, 0x80000000, 0x2546, 0x0, 0x0, 0x0, 0x1, 0xfe1d, 0xd9, 0x5d1a, 0x101, 0x10000, 0xb, 0x4c6, 0x5, 0x0, 0x2, 0x3, 0x40, 0x2, 0x1, 0x3, 0xd73, 0x10000, 0x1000, 0xf, 0x7, 0xfffffffa, 0x5, 0x5], [0x8, 0x7c7, 0x4, 0x8, 0xea, 0xffffff7f, 0xa08, 0x3, 0x10, 0x7, 0x0, 0x7f, 0x2, 0x3, 0x5, 0x5, 0x3ff, 0x3af9, 0xe9bf, 0x81, 0x37, 0x1, 0x3, 0x2, 0x8, 0x7ff, 0x5, 0x7, 0xff, 0x3, 0x15e1, 0x7, 0x5, 0x0, 0x9, 0x6, 0x7, 0xdc, 0x0, 0x8, 0xc, 0x60, 0xb, 0x6, 0x81, 0x70, 0x2d79, 0x4, 0x6, 0x8001, 0xb, 0x0, 0x9, 0x5, 0x2, 0x6, 0x800, 0x4, 0x8, 0x9, 0x7, 0x2, 0x2, 0x5]}, 0x45c) r2 = signalfd(r0, &(0x7f0000000000)={[0x1000000000]}, 0x8) accept$inet(r2, &(0x7f0000000040)={0x2, 0x0, @private}, &(0x7f0000000080)=0x10) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x1f00, 0x8, 0x2, {0x2, @sliced={0x0, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x3]}}}) executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x10) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x50, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x7}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) executing program 0: ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001540)='./binderfs2/custom0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000001580)=[@increfs, @dead_binder_done, @exit_looper], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000004c0)={0x73622a85, 0x1800, 0x3}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000007c0)={@fd, @ptr={0x70742a85, 0x0, &(0x7f00000006c0)=""/231, 0xe7, 0x0, 0x7}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000840)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000001680)=0x3) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_timeval(r7, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) sendmmsg$inet6(r7, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r7, &(0x7f00000071c0)=[{{&(0x7f00000001c0)={0xa, 0x1, 0x10, @local, 0xffff7fff}, 0x1c, &(0x7f0000000140)}}], 0x1, 0x404c804) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x624001, 0x125) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r8, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x7, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x4}, 0x94) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c8, 0x0, 0xa, 0x148, 0x0, 0x10, 0x330, 0x2a8, 0x2a8, 0x330, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr, @multicast1, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x70, 0xe0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b90ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc0d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @local, 0x0, 0x0, 'ip6erspan0\x00', 'veth0_to_team\x00'}, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @multicast, 0x2, 0x7, [0x0, 0x10, 0x1b, 0x2b, 0x37, 0x2e, 0x2b, 0x18, 0x2b, 0x34, 0xd, 0x0, 0x3d, 0x1, 0x32, 0x37], 0x1, 0x6, 0x1570000000000}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x428) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x605, 0xfffffffc, 0x83, {0x0, 0x0, 0x0, 0x0, 0x1001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x8100, 0x0, 0x2004d808}, 0x4050) executing program 32: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x605, 0xfffffffc, 0x83, {0x0, 0x0, 0x0, 0x0, 0x1001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x44}, 0x1, 0x8100, 0x0, 0x2004d808}, 0x4050) executing program 3: r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000080)={0x0, 0x8, 0x2, {0x2, @sliced={0xfdfd, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x3]}}}) executing program 3: ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000140)={0x2, 0x0, [{0x3, 0x1, 0x0, 0x0, @msi={0x0, 0x3, 0x1, 0x2}}, {0x3, 0x1, 0x0, 0x0, @msi={0x1, 0x2, 0x0, 0x7}}]}) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$LOOP_CONFIGURE(r0, 0xc0c0128e, &(0x7f0000000140)={0xffffffffffffffff, 0x1ff, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000f0ffff00", "2809e8dbe10859894822800800000000000097bdb22d0000b420a1a83c5240f45f819e01177d94f98dd4992861acdfffffff160000000400002000", "0000000000000000113ddb2802e7234f00000000ddff00", [0x100000000, 0x82]}}) executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={0x0, 0x0, 0xffffffffffffffff}) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, 0x0, r2, 0x0, 0x274) (async) ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO(r1, 0xc0106440, &(0x7f0000000200)={0x2, 0x36, &(0x7f0000000140)}) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (rerun: 32) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=@ipv6_deladdr={0x2c, 0x15, 0x1, 0x70bd26, 0x25dfdbfe, {0xa, 0xa9, 0x20, 0xc8}, [@IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0xe}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80d5}, 0x10) fremovexattr(r5, &(0x7f0000000480)=@random={'system.', '\x00'}) r7 = socket$inet6(0xa, 0x3, 0x5) ioctl$sock_SIOCADDRT(r7, 0x890b, &(0x7f00000003c0)={0x0, @hci={0x1f, 0x2, 0x2}, @nl=@proc={0x10, 0x0, 0x25dfdbfd, 0x1000}, @nl=@unspec, 0x7, 0x0, 0x0, 0x0, 0x4, &(0x7f00000002c0)='lo\x00', 0x6, 0x1ff}) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x3, 0x9, 0x0, 0x7fff}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_DELETE(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20004000) (async) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) (async) sendmmsg(r7, &(0x7f0000000500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x40000007, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[], 0x108}}], 0x2, 0xc040) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[0x0, 0x0], &(0x7f00000001c0), 0x0, 0x2, 0x0, 0x0, r10}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000300)={0x1, 0x1, &(0x7f0000000180)=[r10], &(0x7f00000000c0)=[0x2], &(0x7f0000000240)=[r11, r11], &(0x7f0000000040), 0x0, 0xffffffffffffffff}) executing program 3: keyctl$set_reqkey_keyring(0x5, 0xfffffffe) request_key(&(0x7f0000000480)='cifs.spnego\x00', &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)='key_or_keyring:', 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) dup3(r0, r1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r2, 0x1, 0xfffffffe, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x1}, @val={0x8}, @val={0xc, 0x99, {0x5, 0x80}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000001}, 0xc8c0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x15e, &(0x7f0000000700)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x128, 0x3a, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa1d3", 0x0, 0x0, 0x0, @private1, @ipv4={'\x00', '\xff\xff', @loopback}, [@srh={0x62, 0x2, 0x4, 0x1, 0x4, 0x48, 0x8, [@private2]}, @srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@ipv4={'\x00', '\xff\xff', @remote}]}, @srh={0x2f}, @dstopts={0x0, 0x16, '\x00', [@enc_lim={0x4, 0x1, 0x1}, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x38, {0x0, 0xc, 0x2, 0x4, [0x1, 0x8001, 0x5, 0x4, 0xe398, 0x7f]}}, @generic={0xfb, 0x35, "9d720c2cecaf014125eec3bd2a94337060d894550f6e6514400e09a9f17e3c0bc4e5d3167c1bb73a973803e24c5fca4f850df3b83b"}, @calipso={0x7, 0x30, {0x0, 0xa, 0x2a, 0x9, [0x129f, 0xfffffffffffffff7, 0xffff, 0x0, 0xfffffffffffffff8]}}]}]}}}}}}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) mkdir(&(0x7f00000020c0)='./file0\x00', 0x1c8) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@mcast2, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xd, 0x0, 0x4000000000006, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0x0, 0x32}, 0xa, @in6=@empty, 0x6, 0x1, 0x2}]}]}, 0xfc}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "14d718", 0x14, 0x6, 0x0, @local, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xfffe, 0x0, 0x1001}}}}}}}, 0x0) r6 = fsopen(&(0x7f0000000140)='omfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x315901c, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='./file0/../file0\x00') ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r8 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x80000) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x8, 0x4, 0x1ffe00, 0x80, 0x1d}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="cf042b7d9200fedbdf251200000008000300", @ANYRES32=r7, @ANYBLOB="0a000600ffffffffffff000014008100050002007f0000000500010003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x1) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x3c, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7f}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x3}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) (fail_nth: 6) executing program 33: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x3c, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7f}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x3}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) (fail_nth: 6) executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x8, 0x600180) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000080)={0x14, 0x3c, &(0x7f0000000040)="43094f8c3494ccf4a8019a937151991adbc8c0653b6aac1b4fc9805165b325195d5541b398259ecdd87971027528f05e25daa40d106fb8d51c15e53f"}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x101000) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000180)={0x0, 0x7b, &(0x7f0000000100)="cb31e13836119038ac95e6377f3503f252ee718fff1004af4d808018a1a5474fde32a5e383b152dc14c4a3a0b3f882d377a993771e51a61032ef83528e4c3e130a9a212492cf9e3a01df90b07141a21debfcfa1cce05f7764491730145a3db28a28a34e32fd1570af5acf5382c0d3e6018b5d8788be301b1eecdca"}) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000) r2 = syz_open_dev$audion(&(0x7f00000001c0), 0x583c, 0x48040) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000200)) write$P9_RVERSION(r2, &(0x7f0000000240)={0x15, 0x65, 0xffff, 0x885, 0x8, '9P2000.u'}, 0x15) write$char_usb(r2, &(0x7f0000000280)="a76457e60571a9282c20f2e1dd7b74d685b7f2039419df1e2f6337248a4b39302216703f54dd4e2a4d1a27f4606bcd04e6ac25c4fe12c0dbff2494bd3a657820e05f40655e472c77a9b8cc0f5950993dae6fc2b6be7f1ddd1300f1d56518f69bf87cdaefaee4b4258530add9ee759be05896bb37ee1477a3afd34082451e549e692f34a7a24f0dfb8838c403e17f5ad082ec7e9c12b4b5b26190d3da93e51446e235b0df1b71539b6ebda263b3a24fab818fe5731b812cbb8c903251b26aaefa14", 0xc1) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x48000, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_mmap}, {@afid={'afid', 0x3d, 0x5}}, {@access_client}, {@privport}], [{@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@measure}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/input/event#\x00'}}, {@obj_role={'obj_role', 0x3d, '9P2000.u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '['}}, {@seclabel}, {@flag='ro'}]}}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r3, 0x10, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IE={0xc, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x8085) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000680)=""/135) fsetxattr$security_evm(r2, &(0x7f0000000740), &(0x7f0000000780)=@ng={0x4, 0x11, "b748a89bec329693c52d8257a445f33a"}, 0x12, 0x0) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000007c0), 0x400000, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r2) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000900)={'ip_vti0\x00', &(0x7f0000000880)={'ip_vti0\x00', 0x0, 0x8, 0x40, 0x8, 0x4, {{0xb, 0x4, 0x2, 0x2a, 0x2c, 0x68, 0x0, 0x1, 0x29, 0x0, @broadcast, @empty, {[@ssrr={0x89, 0x17, 0x1e, [@multicast2, @private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @remote]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000940)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r5, &(0x7f0000000a80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x98, r6, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r9 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/bsg/1:0:0:0\x00', 0x1, 0x0) ioctl$SG_SET_DEBUG(r9, 0x227e, &(0x7f0000000b00)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000b40)={0x2, 0x1ff, 0x204, 0x100, 0x6, 0x9, 0x3c2, 0x9, 0x0}, &(0x7f0000000b80)=0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000bc0)={r10, 0x42, "df674b75de33ab324159e87e3c8b9826b1f7cfbc5bf242f4593d4488fcb16ac1394baf7faa1c701823dc06ba5d460eab589ba4e6b24cb2d89d24d3606dcf78932b39"}, &(0x7f0000000c40)=0x4a) file_setattr(r2, &(0x7f0000000c80)='./file1\x00', &(0x7f0000000cc0)={0x0, 0x5, 0x4, 0x8, 0x7}, 0x18, 0x100) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000d00)={0xffffffffffffffff}) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000002200)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000021c0)={&(0x7f0000000dc0)={0x13f4, 0x14, 0x800, 0xa, 0x25dfdbfe, {0xa, 0x3}, [@INET_DIAG_REQ_BYTECODE={0x101, 0x1, "f35ee609395aa7aeaced46c16a68d148abb9f051bab7f672b8509fe52bfa44a6a61808729b0c17ffc230517cf7c4f99aebeca39b3f194b045d4996bf1441c4beb6f4d7606d631e1489bde15e9c4deee5619a3d77859bebc0ef1d5931e9090a98a7a6b665efa5cfc56c52687c1bd6e50f958b63318fefe4fc82daa9d18f8eab475b7b653f8bfbe89354b2731be4a51ec5a2016d63e9d7b1216f27fc904aa394d3c6fcbf87e9432dfb6e2f93c5e233a74cc5ae5a56fce3af8f4c645f824e29d2e0bece474a38a94efffe580b0d29f611c8c4e0a7468997e44724efef4fc37652348d94cbcff2635bfa5ffe0ee9459aa27fc64b52613addb2ca911087e02b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "cb6ac092ccb90ead4f963c1f180c648b2d37a7dda46782009f6a6f88145913b426a27d680cb051c8d29ac98badf6b61ad1bcd7437d85711e75e9f1a21db93b0dc37d275d2bc6d4e580ac07a9a28556bec2cb3f3a1c975e5d9165f4700bdfc8f08a8431647df9300413a67c4f8f9986c50b3447cd13e453b56848336a2d6d3e8f1c50f75ac2562ee9f85468fd6cef880706d5c05fd9062f3bbb406e0993eab47e90cb6d0d21852f603f6fb2ee09b2faa7f1c8422bac38fac8ba76d90364a7b7f14fb03a27378cfece20bb9ad8528adb3e5f6d14b0085d4567b665c59bf87a11927fe4ae6b45b4f467827bfd6b49fa60b01aa16cf6d3f8bb053c8770a662680838bcd933f4f60da985784bedb8b1f49e8c081ff73f74c61b10241cdbe78335daf920d965587ab1888acc58c6580e691ecd6136737a2a0ecbd062807910372fd6d94082d72e4f429ccc3129f82812aa76f9d3adaee36065bbe022cf48059c006c60f71c73ede709de1fc8f9363d1bc4cf1aaa427ba41cce9816300deb22f5a7a1f960184b46904435cfad2c42cd561911d9ce359bfbb70beceefe391826b461c6e97569f3d5e997e88ed8082f536b2e272c042bb72efc3fde604a487a4a96b0685f9797980898fea076e4905ce898ef0ae9803e9436a91235cf5daf67e133ceef1bc95a56a704bbd0604c5c848b3efae7747b5796cfdb6cb184b2260fd13146bae79a5dcf6865038b80e7702ebc6b11c35e349f88c3405b6d2bd3a11ece767f3be8c4b26df73dcdd2283a1b2da3ab63dd2182b8bdad7d69a1d84e43aafae6a235edbfc5926dda291cb515fd22f8d7838238141d34a2c060ca7cf7f6b9e5ce38b64264943f7a9c6e130a765fef6111018b99979ff91754690a7d8a37814a972f79f6bc28aa88546e966bb0f9989819acc273b5385bc8cc0262aab99ecf60869227d457f692c7c18cf16d9b06e2bbac0b1f89b4b4a3106c48f579f3cc793a32331eb2b0368f34272d43f107c69709e31d757393de65acecebb409bf17fa8956d67e27397899578cd8fc2d23c6acd4d1bcd5f5f18aba2fae34f68ba0ba661875f279783fe864b7550acdf0f4641418832beeabafdd887ba05fcc45f6c17392642202130f6fc6bf4f3f298ee76e7a705852be9a56d86275548234888e00b7261dbdf55c063024026172d124534caef4f44653508f2cbb6666952e593c85a38461dfbb3e1147122bb069e543c8e5ae6bd96dc4bf615bd3b341b77f372751467297ecfaac72fcf874c9ddf4d6d550908fb4b5fcdb2d2fa3d596203ef9eb2a09d0c8f08502f58d67ab0b68ce93d3b1c7e20afc8bfa8105d9f32d7d6c143ce30b7ebb186b17a527a28a1a4b67bd73290a95ff024dc9f42cdaac02bf4474fef2e88db18516d68cdf25f5f021bb613601e551a368b04d5cd473516279c6fa673cec603598a54a5fe55fa4c796c2cf94d00dd1469d1e7da3f61761f6336b18386eaeaac9eb8b854348e5207a41d6b0d553a90b816f0b8351a4a570d2850e873d4e50ad3f486d87f5ac80673124e280e5128cf520053171b39c00ff6f13f7844a621de03aae2eeead5e94216af11616c96b420e95253ef0dd9a0a53861d94b9e5e6b325ea15558871ce52108013dfba5354f5f2d5740e7c6430aa76de6ab5431a804b7632eaa2bca0c09d7efeb3d653f60d22e0534b2899202a2f270bd6e5c58a8d97961ac13eef8ec17f76624087e3732b451d7f46b102b79f3ff7f425c8f2f5f574a1c479f90af19fb42f1a982bf56d978b023973f9cc0fe7a8f2f752cc74ff05616be3ca3c0744ef9b35dd54e6610049f7986b552159ff02f5ccecbd10b59c0d0b4005654fcfb4332a3e8e3a2573ded07892c83e5f1f64a8f4d20c2e4a95c8d0dc00e2009645fbeafb3248ceb3314de922216a153e5e12afdc2e9b27b0833a4b2b01e7997d715a1854550a3d03ebe85e7ba10b285addcb36da348036370dd73cfda63198384d5fa45a5a92afac7b275f570c77a9b0ab60d444a692b59c6dba0a7b12afcbd014ad88320be8b08f098fc8743fbd863a31e85c2603142c0d12d8999284c00f893ae13255e090f019adaa39f97103de80a04b6174c12ee178ae35b99ddc097af224ffaf1408d4e8fb9e4285852857c054273a95744a4f5892161f776854f2bf76ef597693b45bc6e6a025c6e76c686fc4be0d1ee2c8b24a6823450cc8b2b1d76dc781a18d1017547a83dea6a20a43532e44fb8ee02dfed2ae2465c75d2a18de14ebfe8a9ee4f4c7908097ad227f68924ef2196f3c5eac0ec81a6d3a4a58ba0f5f9e437254a3c55df64453481c729f06172168717a4b8976553c5a9609448c97ae9e26b057547557e70c6081487f153d1c89f105142cdfa037e9ca770d9755e530a558e03c75ca7535818046009b18e13c84b1ad88a21fdf34d96bada9aeeeeb74e8907c7d90f52a43d77d1aa827a9feff67d5ec86dbfe25a9fe945d5ee3865866f26e9d72f5d40d9bcb032aab735118f65754a926f2738a2b151e8dfcb713f97cf4e7d81372fe25ac88244257bb9f1b599619899e9e8a408b702ebd5c012da75f537f8d9444083a2edb4e8a2948f962d92467c0998235e0467078524866843c5d20e3b0bdfac629c71cbbf0ca969e11aa23d3a77c9637c03b8f85f919064aa59a92e2b5a419b39370c96465d3b6aedc695fa1393e4060d51392525e8822d7eed5cb5593af0886aee9340cd329d182ecb612471a826382bfecafdd3c822b80ab821774ed385dfa93d284d3ec9977ac93434255340fd79d7af970ccac48e7359652979d060393df23cb1c37e74eb4d749c93f1e6ab1fec72c371b147bc1d9c0e14c5f0c2f47188aaaa1d15dec6ad68c3604c6c7b34405ab707b56d67e3d5b3e222da3e086b50ea30293bbde93cdba3e4d2b65500ddb289f0b388522b6c618cb29553bc96e692f8fa4ee36aa272e5fdfae47aab5f44ec22680e96495ec6733c2ec87d9d47bc96d6a317f89f5fe7b9f27d96498b658fb0d535840e7932445bc561400049a665bd75c1d6161566d6581750f63a8b0c47d57641bb6b5d52c18848d1ba3ea012f4a5694db59f139f469cb750633d15a35c0aedb34d24ffc6afd41b097d7b59ce6ff772b1240845d00bcebbece9e9b87b14be46bc2ad40bf1e4554860c3287b4a9d7d53594bf4cb8e91ee7ed4cb8ba0817518d09355f26b3412cdb4c85e8f0f075be2655ae39979d5cfad616dc6b3e65215b27b9c2936b486b83bfbbbddc5ca703290e7ae1f2fc9cd61a563c7ba7de516929d4eed7dbff688742bca6b235bce2ce9ed152e3e2b6a0cade7017cb912a275049675439a38294080bb4b846a1b64827e923d0c14cec8e4160b84bb944db82fa6e3df896479e17f2b68e99a4cd4b70c9caf93300e16429eae0e4d7afab198d3804e518e88e8f1fb36f9328d462e2354509869192f70540ff7511e767400bab9ab18037da4bd244815bee08d3261781173086d7a3508e40c6009c535abbab5c187c363767a2c67d76060690586180502bcafe78db8c11a592d5f330f06bd3c0f3e938ab482711ab410bf5d6c3180d4db820d73cf2696cf9dc13aec703972f0b73d941e6425e17d31f887a8299f4e02b9d7e55ba8c476758e2e22f53ff003190b7dbc7897451bea8e4be4fed8e1344e555fc09f7b9f413e6b63c190670f2542693cc65fd89fef73161a49e52632a9e596e69d412f50a016efedf98ebbd0d686a8c2d95934c17236bcc9c9fda785d2462380912408b512531e5adf4dcc5091e594cf16a056b85031bef03ab0e2dea7587f767938a061e38b64d134e41707f18d6840730077af68df2a73337fe6e40148675071cb1b66441d0c02183c76c6bdc6f7c2583df188ae3b2858257b1545e5611b7f0d95498c9f933e3f87b15f3011145ce822f1a2e91623ebd17620ed4db6c020b4a7e14043a6006150d81fb099473430e66fc0c0f4266d6f71ec3469fb934160aea045426c6bb17900a464921347b917782ea1868cc06859d36693b8587b5db688c115b49c00aa8c6ccac9ca5491c5c36e3053e57dfa7551291889fee60e3cae5ba221437209b542c38ba7abda28fbfb5962296a661536cf1bd9b55c819b46c939aa8768648b4f98523d81b8157ae8d8b0cf7e91c8ab9ac73a153a71281ebecf71d444de82125cef9601a769f5712c6d15fbccc2d89b241c102cc95e326c740c0a7d8f2546785ce52607ef0424ac30ff5b200b2f8547b34864fba2794b8dca63a755883c07db4ce926959065c6eec8e169d08c1e327e8ada276215078d636564f5514c11134d161b4cffeca4edf8606b38b81595fd77fe2610316542221158b73943e9f5d9d822cd793711d024a154c9241226bf7ed44321d979a9faaa185a65c75fac5a47972995a906659a65848a9c5a13759835a6c4cb4bca36fb5b396d47d0e1ff8a8c4d98468c1598c371e6b57a326a164724ef4badca7ba536e9ece2d3d0a50afdd0db9354e20119a56faaa6b475b241cc844f199b7d510672ec63c04899404b0de2f7170e88da7c39966a87fb95d1bcd4bdf53867297b27da13db1812fa571b2d72ef8b02059ee89a24b91536d553b240a77d3526af13bf74d66acfb1907f28b031e8660e17a2b7f31b3112898a47bc308c498a4d13e7887f1d2f6e4f6a9270ee01bde35c1f1b891d091acbb5e7f5d8eb89f267895ebcd6d0a6366fb0ecf3d38bda1a73f04e5ca83c0fe9092b0f673572a415007af2e44c67c585bcd3d6c96bb34f120272a99ad8ea0bce654298b90295707b830b1bd9e3b34135a53f444b53c94e460825a35b8ad0428f6a53b791a2e3a0e9bd0a32b08f8456b347642a87bc82b2e6585c522f0db88ea2f45af2723b87be493566cb85c96220cd512f858b76dddd2edb7666371b6b04a2373e78fd35c9086858402712c96247d318d3adb7152eee7337fbe2d12702031fc6717523b17132a9ae96ebbafb6a356b825ee15ccc16dbe705975430cbd4ffcf4370810f10f16bdcaf90234213e011da00945dcf163e52e929204ecb417de0498c743b2765498925da0388d869bb897d16d623771b1f63e6d79d814dc0fb7cd735bae0f81368c39d52e8ebe0c5f3b9ca5ca08087a34d4de0fe3710935a13469e7716b452e79e31c9ec39d4cea2664d71336aa3e4ca25e28696cffb088ed1abb1a0edf759d151313c7c285708adace19b369397a1978ccbc3b736414490a425bb8c7b8641372b56f61821c60c19a7d0e918bbbaaedc832ee7deee6d31102ef6ab59bb430b23ac7491fa17409d3266a471fa08107877b21690aed465bfd64b48fd4d4b4db3fe3a0e3a20f267981810eee5e3a7268011925cc60e90a7f5606b04dc2ff80123194065e58282e86aa3b838c017ecc0dc1cf3f882db387aaf8bba4a99c596660aa3d4239b4042ab66a55559086c86cb4644d8390437efa261728e749ea3fc39d5b7b28c990d86b140b2a7664c88c63a19a85541399b6a9ba3e3d134dc53d6e83cc83f86d82e121e99027742a4ddd1b93540e95c15260b555ddbab7119271b507cc054185a1fe58cd1d925180b729dd1cae5bb6bb53cba750f34ad95eac6360add144b91dc4eaa2a8dbc6639e28f5334e1f4864d6968c1cc9ee62576463ba164bd444cfeb1e2eac850e46154abda9df696d471e28cb79d62cb6d74e61ec5a199c35c28abc3aad184e5343cfe806167c2fa36b12056867321755096b3d330e6295217dfdb922cca1661678128660bb5837800e67f316be8ca03d5b85a6ffe90d9f695255c40c2f25b4401c38d636"}, @INET_DIAG_REQ_BYTECODE={0x28, 0x1, "76b873323c268a8652f79e1aa8cc77781d7ab239a9dcba7f9f6ed8548f5ec8399923061b"}, @INET_DIAG_REQ_BYTECODE={0x9f, 0x1, "d19d54b0b1431f0c9cebcbf83f5ab3560b1a60e6b2b18aff87ced6016f2c0cf2918f92e8eca1f2618aee3cf19651887ff5a926b8c343aefe7a1234ddd560c4dc65385f533b948ce9e289b4b02fe77e28b46bdbe1a622c90035f3d84a0f2f4a10943a62c70265029934d806ef53396a9a0df863ed326d38581dde347228022f589c1f7d7f815ae5eb51ea600784f101cb26d53214027fc5309ec261"}, @INET_DIAG_REQ_BYTECODE={0xc2, 0x1, "7b90a259da738884c7f4b2d218fcc9efb8505d536b7ba7099fb36905e3c82114eb0a72485886948ac75fc7a7a2a44681f0951a8bbc60b1538b2318f4ac0daaebb274bb537cc786dfecb3be3478e58c6a061cc1f144d806853290b08d07429eeeeb8624642791c1518cc5b354e728e968de5e23ef3971d39446e3869de9f70dbc6cc49e28eb668f2a3d382b5600b2d55f46f4df6b7ce5705bb00564d8df3cc7429204a1e18dd386698e1e5e543929513f07d2e5a74e2e42939dc8f1c47dac"}, @INET_DIAG_REQ_BYTECODE={0xde, 0x1, "14a5aa221f8400be3a7d282b278e705cc4b7634f89b6c0a664ccdc4f14c5692eb70e37b0eafcc7c3a9b95836b9ced8363caeb193a2ddabe0e39d652bd4a777ce1f43b0d2479e27bd34c77de30c9bd9062f70ffa54db65609377cb7e03a8d952d3f89a9548eaef97f4fa072017e5851917024006ab77e3616098fff601e2658a448f60ec9a1de66e7ddb224271a56dfcd59e42eb8f641bd2a72acf3efff2799bfab66a5a7ec4809c21368fdf7266b958b583d504df2ca2138fbe711f70748b079b346a1f84887ffbf7320ce42941f5dc29fa3d9c16764c2b2a8f7"}, @INET_DIAG_REQ_BYTECODE={0x5c, 0x1, "88f697aa058dbfe4784e141cd2f1cddb7ab0daa1e15f7985bfd5faee93b78428c75bca2e5e96084c78d3b8d6f71dea0f65142c79f820f32cca2c0eb7bd0f7a124f2542518b7b4c122fe3c18576cd89acddb58849e5c8d127"}, @INET_DIAG_REQ_BYTECODE={0x10, 0x1, "096cc226913a47530d935e0c"}]}, 0x13f4}, 0x1, 0x0, 0x0, 0x4040004}, 0x24004001) r12 = semget$private(0x0, 0x1, 0x20) semctl$GETZCNT(r12, 0x3, 0xf, &(0x7f0000002240)=""/149) semctl$GETALL(r12, 0x0, 0xd, &(0x7f0000002300)=""/246) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x95ff, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 2: socket$nl_audit(0x10, 0x3, 0x9) (async) r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003400)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003400)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r2) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006a00), r2) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000006bc0)={0x0, 0x0, &(0x7f0000006b80)={&(0x7f0000006a40)={0x38, r3, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_AUTH_PROTOCOL={0x5, 0x8, 0xf4}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x24000800) syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x30e}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) (async) r4 = syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x30e}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r4, 0xb, &(0x7f0000000b00), 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r5, &(0x7f0000000280)={0x2, 0x4e22, @broadcast}, 0x10) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r4, 0xc, 0x0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000000)={@val={0x0, 0x88f7}, @void, @eth={@random="e21debcc1332", @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}, {0x1, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffff5865}}}}}}}, 0x3e) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000124d5240e316e9f958000000000109021b00010000000009047800018fa68d000905", @ANYRES16], 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x2, 0x123141) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(r4, 0x2e6f, 0x8555, 0x2, 0x0, 0x0) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='qnx4\x00', 0x208004, 0x0) (async) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='qnx4\x00', 0x208004, 0x0) executing program 2: r0 = openat$ndctl0(0xffffffffffffff9c, &(0x7f00000001c0), 0x121000, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x0) write$uinput_user_dev(r1, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xc559, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x8, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000000, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0xffffffff, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x200000005c832, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0xa0, 0x4) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40086602, &(0x7f0000000000)) symlinkat(&(0x7f0000000200)='./file0/file0\x00', r2, &(0x7f0000000240)='./file0\x00') ioctl$UI_DEV_CREATE(r1, 0x5501) close_range(r0, r1, 0x0) executing program 2: prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x50000}]}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000001180)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000a00000000008000f0fffeffe809005300fff5dd00000010000100070c10000000000000000000", 0x58}], 0x1) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000080)) executing program 2: r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x7, 0x0, &(0x7f00000000c0)) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x49, 0x1, 0x2, 0x0, {0xa, 0x0, 0x6e80}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="28000094a6c72421ae2000a4fc5caa69d05da9f19bc49befa4632f25942fb4ee", @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25080000000400068008000300010000000500050080000000"], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x20040800) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r5, r4, 0x1c, 0x3, 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5f0, 0x2f0, 0x2f0, 0xe0, 0x3e0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x420103, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) executing program 34: r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x7, 0x0, &(0x7f00000000c0)) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x49, 0x1, 0x2, 0x0, {0xa, 0x0, 0x6e80}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="28000094a6c72421ae2000a4fc5caa69d05da9f19bc49befa4632f25942fb4ee", @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25080000000400068008000300010000000500050080000000"], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x20040800) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r5, r4, 0x1c, 0x3, 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5f0, 0x2f0, 0x2f0, 0xe0, 0x3e0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x420103, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x6558000000000000}, 0x0) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000080)='|') ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000500)="d7") ioctl$sock_bt_hci(r2, 0x400448e7, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x4000) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newlink={0x44, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x7fff}]}}}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r9 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000380)) r10 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x60, r5, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x2a}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r9}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r10}, @NL80211_ATTR_NETNS_FD={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x20004001) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000000)={0x42b9bd9b, 0x0, @qam={0x3, 0x6, 0xf}}) recvfrom$phonet(r3, &(0x7f0000000100)=""/124, 0x7c, 0x2, &(0x7f00000001c0)={0x23, 0x8d, 0x1, 0x3}, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000180)={0x38, r1, 0x1, 0xffffffff, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x811}, 0x8880) executing program 5: mkdir(&(0x7f0000000000)='mysys\x00', 0x15f) mount(0x0, &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @empty, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x73, 0x0, @private, @broadcast}, {0x0, 0x0, 0x8}}}}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mysys/module/loop/parameters/max_loop\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) fstat(r1, &(0x7f0000000240)) read(r0, &(0x7f0000000500), 0x64) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000080)={'veth0_macvtap\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x48) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r4, &(0x7f00000020c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000118f715b6458ace4b0000000000000000000000000a3c000000120a090001000000000000ed0200fffd0900020073797a3100000000080005400000001d0900010073793a30000000400800034000000003140000001100010000000000"], 0x64}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) unshare(0x2a020480) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0xa0, 0x0, &(0x7f0000000300)="b44c806748f06309624431ed3373010001000000008c6390009c4ebd873094563683b7ee0fae7a6a53200386ce51def6a4effb9de8b4645c2b9c0614907dac12c6d34a8266e6124b925240080cd4f4e5b5da601596c31f137d2ce6ca74fd87f90ea0be786fe13ac0805807dd6853458eccc84575e9af5fee935d3bc54f9bdf5cf073b5a597a9df9cb422ce2ab5ff0700000000000093b110a54f32ad69d05a80", 0x0, 0x405, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r8 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) ioctl$FIBMAP(r8, 0x1, &(0x7f0000000040)=0x85) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r10 = syz_pidfd_open(r9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000440)=ANY=[@ANYRES32=r2, @ANYRESHEX=r6, @ANYRESDEC=r2, @ANYRES32, @ANYRESHEX=r2, @ANYRES16=r4, @ANYRESHEX=r5], &(0x7f0000000340)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$EXT4_IOC_MIGRATE(r10, 0xff07) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6f9b475dc3dec0012100001400a0c0c00bdad446b9bbc7a46e4988285dcdf12f21308f868fe3a4ffa81f9219a1e18c488e827c1bbec677217bde85a10182478a2", 0x89}], 0x1}, 0x0) executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 35: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) futex(0x0, 0xc, 0x0, 0x0, 0x0, 0xc5fffffd) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @mcast1, 0xffffffff}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x4000000, 0x4000002, 0x2}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r1, 0xc01064c7, &(0x7f0000000200)={0x2, 0x0, &(0x7f00000001c0)=[0x0, 0x0]}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000061000000000000006926000000000000bf67000000000000150600000fff07e03406000043fe0000070600000ee60000bf050000000000003d6500000000000065070000020000e3260700004c0000001f75000000000000bf5400000000000007040000f0fff8ffad350100000000009500000000000000050000000000000095000000000000001c0a7900009d3c2792138e042ce31c2b7ae994a5642cb064ecd5615f3196e3359aceb768637e60bd5d2e4b5992de991371274fdff6e79fc722e25659a7c85615c1b88bc894123cfe3614e887ffffff7f381ef4932cb0dcebea6d90e9c1677fbefd35893d883a2c559b7a34db461b197baf8ebb7c11a8df40d92706d0bbcc5bf6fec345ae9606c3c1a348f9b395592c1f9ae5de8923b27a6fdc20441018e5e4b41b13000c94df1f2db24c67d4c7ba9ec035883e2791a9e9dff3e8bfc7d1be00000082018f5f4b2c00000000000000387a601e3a3412086dee84efd375f0645f3301f55d3b9efdfbed9b430bcf0418e100bdff1c8bcfc0c229874bc3d2418bab997c8bef9aa55841caa572ddff9220c67c9e17bee524c3dc747445763ecb0a7f2cd12bc34b0fc6273786b5bba17e9b8f1c2af8e23c411a4d1124cfb5279195f701000000f77c71294bbfd85878726c49eb89085967722d98cb884d1afe82f7f722e38397996271700241094d272dd8b754b2dd7817450bc7921dd372e621dd447b86e7ffd1bdc198deb495cac0995ca3ef6c1affb693ae366b0f11db6e312bdb8261d0dc10cac6a27e29f171b8e9f172c3db24558d77b8bf18be45c50b3fc005fa7b134dfc948f6015e0389d7f34cb9c02cf517c8ed7a9b6159c1446ef1c2ccff2bde95aa860ed9b836d6b8fcab7663d9bd8415e6f90fdb007b8f3e009000000000000002eb85073720c1df1147c9f5013c82fc98604bd70cd56609a6b73943748a90002d9cf81bcb1d262845762f6b0a284cc463b42492bab0f7b25895cc3ba8bf0b5e0fc018463d03a73fa85429725545128b0e9b550a13d0dd35092250bbce4f618cad2375a34c7f15c3096f3e9004468cf1aba4a6f22ed0eb3681c6963205eefc072ab79ad8b126500419e25a94ce13a7a96deac79c90b8df10b1e364cf97eaa49fd2294320fad0d814f230f954eec844f6b658ee04eb1c6d655a3383928d6e0307a7097b0a5fa5040958d2b7ad0eb7605a7de7ce9cf0e6b472d764976fbf7edd83dac8b9273976bfd6090de0a73cf8a9b2c23500a4054703e2df18d8498356e3c1cd6418e149f8a22e95da26221d8a69b642915471f4917571357aa9df385c0532d6e70263ec616f88dc8f93c886ede7743c53d738b9c7021f0032970eabd2808c53128b3eb600f2614256184c506454980e542ce450029aa6de147a8c81e6f701a4b9b278b08e4b02710907923f0797f96413054f2d1b5f2ba0c49567b53db5d862acf2c42faa37c4a8738f64ed7fef9ffba58a3c1ca52b55aef071e4f11334e3a70918e5b18dab84decde74d616b5b05c96378acc79375a7ebdb54b01d512de48184950f5cac97f0a6dcc6d12c48c6e3b925fee7974ca8f3009188bbecc30e1adbc290ac99555ec069636a8079f8ca80343ff84e896dda2d4148f982feff6b38699fb57aab5596479f84b59daa9a406c5119761d5aabb51c5175461f8b0aa7265c380317f08775d8a8a8bda64ada2c6b3599f548d6272937e4d89ef6ebcecf84fa856024b55dd057056bbae005f0fba858f3abdd9c115064000000000000000000070b0bb28fd1eca97a90864863235d415379d1bdb3d35015f85be2ae802455d3b079f12aa837996ca1ce7280cb394b4c13ca623c30b19887d41eab495f698284a1bc17ff100000000000000000000dac089bdf7984e3300000000"], &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8}, 0x94) executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240), &(0x7f0000000100)=@v1={0x2, "79eb"}, 0x3, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x10) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x401, 0x800000, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x7}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) executing program 4: creat(&(0x7f0000000300)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x83, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x4, 0xe9, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000001, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x54000, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000500000028000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000004"], 0x50) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='hugetlbfs\x00', 0xc00, 0x0) executing program 4: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) flistxattr(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x800) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0x7f) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000140)=""/210) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 36: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) executing program 6: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 7: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe00000000f0ffff08000f00fd000000", 0x24) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc400000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180050001"], 0xa4}}, 0x40) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x2e3}]}) syz_clone(0x8003011, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fanotify_init(0x10, 0x2) r2 = syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$TIOCEXCL(r4, 0x540c) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) fanotify_init(0x10, 0x2) (async) syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') (async) socket$inet6(0xa, 0x2, 0x0) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) (async) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) (async) ioctl$TIOCEXCL(r4, 0x540c) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') (async) read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) (async) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) (async) executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x0, 0x9eff}, 0x0) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc601}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="034886dd09032800050030000300600000000228290081e949b93897bc3b0000000000007d01ff020000002900000000000000000001"], 0xfdef) executing program 7: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2008c040}, 0x0) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100800112010002000000400000f0ffff0000000001", 0x1f) executing program 7: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000007c0)={0x28, 0x6, r3, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000000c0)={0x28, 0x3, r4, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000080)}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='60\x00', 0x3) close(r6) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80c, 0x20}) executing program 8: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0xffb0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 6: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000013005f0214f9f407000982001f000000fe0000000000000008000f00fd00f000", 0x24) executing program 8: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x2a, 0x8, 0x4, 0x7, 0x7, 0xc0, 0x1, 0x3, 0x5, 0xdf, [0x80, 0x0, 0x32, 0x7, 0x0, 0xa0, 0x10, 0x5]}}) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001000010001000000ffdbdf2100000000", @ANYRES32=r2, @ANYBLOB="850b010000ffc300140003006d6163736563300000000000000000000a000100aa"], 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) executing program 6: r0 = socket(0x10, 0x3, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000000c0), 0x86000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000001200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000000ec0)={0x2cc, r2, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf01}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7c}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x656}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe5ed}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvtap0\x00'}}]}, @TIPC_NLA_NODE={0x1a4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "fdc9dc06e28d69bd7edd2dc083c591a9ea5271c3c274fb0a9ae5a55efb2e72ac3d80"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "25c45a06a150c8204ae4564dd31169897814c462cc0b81ed213e75166ad104ef0e8a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xee, 0x3, "4e05286ac28fa059c97f9a2d8857dc9cd84534c3dd67a0b8d84a0cefdd9da4e2dff552a79af512322c324d504a86e040b7acd2469b63e7b076a96995fc756d6fb3bc2654bcf6ca6020170a4abbbb1a96fa27e21db92ee172e488e6d6ad8666b9aa919017ffdb562e63700e1597fe979fb1aaca8dc03644462a50b5d9a6b60f94c20617e9864be4e92e4d7c26d7f53b26be108d9a0bcaaec4fefa88d8cb426cfe4591bd9883a84b60002cf107425a10f5bf9494044f88156f4ebf66aa6da151e18df6dca672681411d8886f490d7ad2050fcff8f749ce9047306e780dd3ddcfef23f1a8d1fa4d30ce5b08"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x2cc}}, 0x40010) ioctl$CDROMSTOP(r1, 0x5307) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sysvipc/msg\x00', 0x0, 0x0) ioctl$CDROMREADMODE1(r1, 0x530d, &(0x7f0000000440)={0x7e, 0x5, 0x3, 0x4, 0x9, 0x2}) mmap$IORING_OFF_SQ_RING(0x0, 0x3000, 0x1, 0x12, r3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYRESHEX=r3], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getnexthop={0x24, 0x6a, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4014}, 0x8040) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x20040000) executing program 8: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 6: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204441, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x4, 0x1c, [0x86, 0xc6fb, 0x2, 0x8, 0xffff, 0x8001, 0xd2b]}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x8, 0xd, 0x2}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x0, 0x10, 0x28, @loopback, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0x8, 0x0, 0x5}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x254, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xd0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x602}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '))\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '+:#]:^{,\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd990}, @ETHTOOL_A_BITSET_VALUE={0x52, 0x4, "c48c3b1ecd83ae6d926c4e769605e38ed11362a73088aae43386621cd8fb5dbc6f316de974d19b5bb20512ea350fd0765e53e19ce71d8e3a3ab5c50b07b2a9e61479fd97c3e95196386e868d7bc6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_VALUE={0x96, 0x4, "fb4a3dac77735041db4a035116940b893348c64261d6055424fe137ad91fa6cf0a91ef9764f29e1bb72dad61a4a09080892b20764f819901b14de30f3fb7ca40f67ad0bd2e5fd1c37d86c79e1acea352091ee6aa97e45479884397d21203e1be44c61d122c64127d801c25d27cdc01bf18d65145d9967e4b1ebffddb9fb02b48db2046a76c4480820f20dbf61d702796a017"}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\\\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000005c0)) write$cgroup_subtree(r0, &(0x7f0000000600)={[{0x2b, 'rdma'}, {0x3b, 'cpu'}]}, 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x6c, r5, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1a7, 0x16}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x10}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x4]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x9f5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x200}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x38}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x4000) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000800)=0x1, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f0000000840)={'syztnl0\x00', r3, 0x10, 0x7800, 0x8, 0x1, {{0x12, 0x4, 0x2, 0x6, 0x48, 0x64, 0x0, 0xfc, 0x29, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x24, 0xf8, 0x0, 0x3, [0x1, 0xca91, 0xff, 0x2, 0x4, 0x0, 0x400, 0x6]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x4, 0x79, 0x3, 0x9}, @end, @ra={0x94, 0x4, 0x1}]}}}}}) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000900)=0x983b, &(0x7f0000000940)=0x2) r7 = accept4$bt_l2cap(r0, &(0x7f0000000980), &(0x7f00000009c0)=0xe, 0x80000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000a00)={0x2, 'veth1\x00', {0x9}, 0x9}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) ioctl$UI_GET_SYSNAME(r8, 0x8040552c, &(0x7f0000000a80)) getsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r9, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bind$inet(r8, &(0x7f0000000c40)={0x2, 0x4e20, @remote}, 0x10) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0xac, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8014}, 0x20000800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000e00)={0xe, 0x14, [0x8d84, 0x9, 0xffffffff, 0xd, 0x10]}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) r10 = openat$null(0xffffffffffffff9c, &(0x7f0000000ec0), 0x204000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r10, 0x84, 0x1b, &(0x7f0000000f00)={0x0, 0xe4, "2d49b43fa2f1f5a74c17301b9d137a34e4c10785ad2bec3b418fa72d97855a3557ec3ee64e1fb1c338d9b5fd8442b178ce668aaf4be20897c72f4b583f632f46df5edcd13db4147c0515467335ec03507055863a7344c795f827eb0b0c523638bc51e132ed7859ef4781474d082b672728077947409363ce2394cc9e0b83c4ac95fee850d3f0d43c56664b51b2672dbd46095514e55e661efc962d5fca6b9507fe35611facb9eb03525f81e16dbbe075631510314ab2c4ee6fbedccb5cf04e33704f0c66027730106ea743551469b286d0cd9625596a9df2ade1f34fe2913305d12688f2"}, &(0x7f0000001000)=0xec) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f0000001180)={&(0x7f0000001040), 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x4}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x7}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8095}, 0x2004c085) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 16) executing program 6: unshare(0x60040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000300000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program crashed: KASAN: slab-use-after-free Write in snd_usb_midi_v2_free bisect: bisecting 59 programs bisect: split chunks (needed=false): <58> bisect: split chunk #0 of len 58 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m49s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 29, 2, 29, 24, 30, 30, 30, 9, 7, 13, 10, 8, 5, 5, 22, 15, 3, 12, 24, 2, 29, 7, 5, 20, 3, 2, 9, 11, 13, 18, 30, 13, 4, 12, 15, 13, 2, 20] detailed listing: executing program 34: r0 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x7, 0x0, &(0x7f00000000c0)) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x49, 0x1, 0x2, 0x0, {0xa, 0x0, 0x6e80}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="28000094a6c72421ae2000a4fc5caa69d05da9f19bc49befa4632f25942fb4ee", @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25080000000400068008000300010000000500050080000000"], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x20040800) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_COPY(r3, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r5, r4, 0x1c, 0x3, 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x5f0, 0x2f0, 0x2f0, 0xe0, 0x3e0, 0x1c0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x108, 0x130, 0x48000000, {}, [@common=@inet=@udp={{0x30}, {[0x4e20, 0x4e23], [0x4e21, 0x4e21]}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0xd, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x420103, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x6558000000000000}, 0x0) executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000080)='|') ioctl$sock_bt_hci(r2, 0x400448e6, &(0x7f0000000500)="d7") ioctl$sock_bt_hci(r2, 0x400448e7, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x4000) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newlink={0x44, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x7fff}]}}}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r9 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000380)) r10 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x60, r5, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0x2a}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r9}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r10}, @NL80211_ATTR_NETNS_FD={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x20004001) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000000)={0x42b9bd9b, 0x0, @qam={0x3, 0x6, 0xf}}) recvfrom$phonet(r3, &(0x7f0000000100)=""/124, 0x7c, 0x2, &(0x7f00000001c0)={0x23, 0x8d, 0x1, 0x3}, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000180)={0x38, r1, 0x1, 0xffffffff, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x811}, 0x8880) executing program 5: mkdir(&(0x7f0000000000)='mysys\x00', 0x15f) mount(0x0, &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @empty, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x73, 0x0, @private, @broadcast}, {0x0, 0x0, 0x8}}}}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mysys/module/loop/parameters/max_loop\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) fstat(r1, &(0x7f0000000240)) read(r0, &(0x7f0000000500), 0x64) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000080)={'veth0_macvtap\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x48) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r4, &(0x7f00000020c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000118f715b6458ace4b0000000000000000000000000a3c000000120a090001000000000000ed0200fffd0900020073797a3100000000080005400000001d0900010073793a30000000400800034000000003140000001100010000000000"], 0x64}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) unshare(0x2a020480) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0xa0, 0x0, &(0x7f0000000300)="b44c806748f06309624431ed3373010001000000008c6390009c4ebd873094563683b7ee0fae7a6a53200386ce51def6a4effb9de8b4645c2b9c0614907dac12c6d34a8266e6124b925240080cd4f4e5b5da601596c31f137d2ce6ca74fd87f90ea0be786fe13ac0805807dd6853458eccc84575e9af5fee935d3bc54f9bdf5cf073b5a597a9df9cb422ce2ab5ff0700000000000093b110a54f32ad69d05a80", 0x0, 0x405, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r8 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) ioctl$FIBMAP(r8, 0x1, &(0x7f0000000040)=0x85) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r10 = syz_pidfd_open(r9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000440)=ANY=[@ANYRES32=r2, @ANYRESHEX=r6, @ANYRESDEC=r2, @ANYRES32, @ANYRESHEX=r2, @ANYRES16=r4, @ANYRESHEX=r5], &(0x7f0000000340)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$EXT4_IOC_MIGRATE(r10, 0xff07) sendmsg$kcm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6f9b475dc3dec0012100001400a0c0c00bdad446b9bbc7a46e4988285dcdf12f21308f868fe3a4ffa81f9219a1e18c488e827c1bbec677217bde85a10182478a2", 0x89}], 0x1}, 0x0) executing program 5: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 35: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000001480)='\x00\x88\x8a\xf8\xd3\xe1\x01\xd1\xea\xb9`v\xb8\x85D\aK\rq\x9a\xc5\xab\xbc\x80\xfb\xe3,\x84\x99\v\xe1\x7f\xa1;4\xd6\xa0\x04M\xe80(\xde\xbc\'P\'\xf8I\xb3c\xee\"\xc4P\x11\xf62\xaa:\xe0b\xd3~\xbc\xdd\xed\xdd\x1dOnKo9\xc58\b\xff\xb5\x18x\xa5c\xcavYR\xdfx\xc6#\xf7s\v\xb9t\x1c\xd8\x06\xe8Lo7\xb7\xb4\xf2\xe6fK\xfc\r+M\x80\x90\x98\xd9A\xfc\xf1nG\xda\xfeR\xc0aQ\x93') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/aql_enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='0\n', 0x2) pread64(r1, &(0x7f0000000700)=""/100, 0x64, 0x0) write(r1, &(0x7f0000000800)='1\n', 0x2) pread64(r1, &(0x7f0000000900)=""/100, 0x64, 0x0) r2 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041c0200c9"], 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffff0}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x920e}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa053}, 0x20880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r8, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRESOCT=r7, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES64=r3, @ANYBLOB="2800128008000100687372001c00028008000100", @ANYRES32=r6, @ANYRES32=r6, @ANYRES32=r7], 0x50}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80444d1a, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mount(&(0x7f0000000180)=@sg0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)='ocfs2\x00', 0x200800, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r9, 0x0, 0x97, 0x8000000}) setresuid(0x0, 0xee00, 0x0) r10 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r10, 0x8004510a, &(0x7f0000000100)) setrlimit(0x40000000000008, &(0x7f0000000000)) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000000c0)={0x28, 0x2, r9, 0x0, &(0x7f0000ba3000/0x3000)=nil, 0x3000, 0xa}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) futex(0x0, 0xc, 0x0, 0x0, 0x0, 0xc5fffffd) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @mcast1, 0xffffffff}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x4000000, 0x4000002, 0x2}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r1, 0xc01064c7, &(0x7f0000000200)={0x2, 0x0, &(0x7f00000001c0)=[0x0, 0x0]}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000061000000000000006926000000000000bf67000000000000150600000fff07e03406000043fe0000070600000ee60000bf050000000000003d6500000000000065070000020000e3260700004c0000001f75000000000000bf5400000000000007040000f0fff8ffad350100000000009500000000000000050000000000000095000000000000001c0a7900009d3c2792138e042ce31c2b7ae994a5642cb064ecd5615f3196e3359aceb768637e60bd5d2e4b5992de991371274fdff6e79fc722e25659a7c85615c1b88bc894123cfe3614e887ffffff7f381ef4932cb0dcebea6d90e9c1677fbefd35893d883a2c559b7a34db461b197baf8ebb7c11a8df40d92706d0bbcc5bf6fec345ae9606c3c1a348f9b395592c1f9ae5de8923b27a6fdc20441018e5e4b41b13000c94df1f2db24c67d4c7ba9ec035883e2791a9e9dff3e8bfc7d1be00000082018f5f4b2c00000000000000387a601e3a3412086dee84efd375f0645f3301f55d3b9efdfbed9b430bcf0418e100bdff1c8bcfc0c229874bc3d2418bab997c8bef9aa55841caa572ddff9220c67c9e17bee524c3dc747445763ecb0a7f2cd12bc34b0fc6273786b5bba17e9b8f1c2af8e23c411a4d1124cfb5279195f701000000f77c71294bbfd85878726c49eb89085967722d98cb884d1afe82f7f722e38397996271700241094d272dd8b754b2dd7817450bc7921dd372e621dd447b86e7ffd1bdc198deb495cac0995ca3ef6c1affb693ae366b0f11db6e312bdb8261d0dc10cac6a27e29f171b8e9f172c3db24558d77b8bf18be45c50b3fc005fa7b134dfc948f6015e0389d7f34cb9c02cf517c8ed7a9b6159c1446ef1c2ccff2bde95aa860ed9b836d6b8fcab7663d9bd8415e6f90fdb007b8f3e009000000000000002eb85073720c1df1147c9f5013c82fc98604bd70cd56609a6b73943748a90002d9cf81bcb1d262845762f6b0a284cc463b42492bab0f7b25895cc3ba8bf0b5e0fc018463d03a73fa85429725545128b0e9b550a13d0dd35092250bbce4f618cad2375a34c7f15c3096f3e9004468cf1aba4a6f22ed0eb3681c6963205eefc072ab79ad8b126500419e25a94ce13a7a96deac79c90b8df10b1e364cf97eaa49fd2294320fad0d814f230f954eec844f6b658ee04eb1c6d655a3383928d6e0307a7097b0a5fa5040958d2b7ad0eb7605a7de7ce9cf0e6b472d764976fbf7edd83dac8b9273976bfd6090de0a73cf8a9b2c23500a4054703e2df18d8498356e3c1cd6418e149f8a22e95da26221d8a69b642915471f4917571357aa9df385c0532d6e70263ec616f88dc8f93c886ede7743c53d738b9c7021f0032970eabd2808c53128b3eb600f2614256184c506454980e542ce450029aa6de147a8c81e6f701a4b9b278b08e4b02710907923f0797f96413054f2d1b5f2ba0c49567b53db5d862acf2c42faa37c4a8738f64ed7fef9ffba58a3c1ca52b55aef071e4f11334e3a70918e5b18dab84decde74d616b5b05c96378acc79375a7ebdb54b01d512de48184950f5cac97f0a6dcc6d12c48c6e3b925fee7974ca8f3009188bbecc30e1adbc290ac99555ec069636a8079f8ca80343ff84e896dda2d4148f982feff6b38699fb57aab5596479f84b59daa9a406c5119761d5aabb51c5175461f8b0aa7265c380317f08775d8a8a8bda64ada2c6b3599f548d6272937e4d89ef6ebcecf84fa856024b55dd057056bbae005f0fba858f3abdd9c115064000000000000000000070b0bb28fd1eca97a90864863235d415379d1bdb3d35015f85be2ae802455d3b079f12aa837996ca1ce7280cb394b4c13ca623c30b19887d41eab495f698284a1bc17ff100000000000000000000dac089bdf7984e3300000000"], &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8}, 0x94) executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240), &(0x7f0000000100)=@v1={0x2, "79eb"}, 0x3, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x10) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x401, 0x800000, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x7}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) executing program 4: creat(&(0x7f0000000300)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x83, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x4, 0xe9, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000001, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x54000, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000500000028000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000004"], 0x50) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='hugetlbfs\x00', 0xc00, 0x0) executing program 4: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) flistxattr(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x201899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x18f881, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x800) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0x7f) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000140)=""/210) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 36: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="05000000000000000b000200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000000250300000000000008002600b409"], 0x80}}, 0x0) executing program 6: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) executing program 6: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 7: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe00000000f0ffff08000f00fd000000", 0x24) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc400000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180050001"], 0xa4}}, 0x40) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x2e3}]}) syz_clone(0x8003011, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fanotify_init(0x10, 0x2) r2 = syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$TIOCEXCL(r4, 0x540c) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) fanotify_init(0x10, 0x2) (async) syz_open_procfs(0x0, &(0x7f00000044c0)='stat\x00') (async) socket$inet6(0xa, 0x2, 0x0) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0xfff8, 0xfffd}, 0x20) (async) fanotify_mark(r1, 0x11, 0x8000013, r2, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) (async) ioctl$TIOCEXCL(r4, 0x540c) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') (async) read$FUSE(r2, &(0x7f0000004500)={0x2020}, 0x2020) (async) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) (async) executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x0, 0x9eff}, 0x0) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc601}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="034886dd09032800050030000300600000000228290081e949b93897bc3b0000000000007d01ff020000002900000000000000000001"], 0xfdef) executing program 7: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2008c040}, 0x0) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100800112010002000000400000f0ffff0000000001", 0x1f) executing program 7: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000007c0)={0x28, 0x6, r3, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000000c0)={0x28, 0x3, r4, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000080)}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='60\x00', 0x3) close(r6) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80c, 0x20}) executing program 8: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0xffb0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 6: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000013005f0214f9f407000982001f000000fe0000000000000008000f00fd00f000", 0x24) executing program 8: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x2a, 0x8, 0x4, 0x7, 0x7, 0xc0, 0x1, 0x3, 0x5, 0xdf, [0x80, 0x0, 0x32, 0x7, 0x0, 0xa0, 0x10, 0x5]}}) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001000010001000000ffdbdf2100000000", @ANYRES32=r2, @ANYBLOB="850b010000ffc300140003006d6163736563300000000000000000000a000100aa"], 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) executing program 6: r0 = socket(0x10, 0x3, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000000c0), 0x86000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000001200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000000ec0)={0x2cc, r2, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf01}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7c}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x656}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe5ed}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvtap0\x00'}}]}, @TIPC_NLA_NODE={0x1a4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "fdc9dc06e28d69bd7edd2dc083c591a9ea5271c3c274fb0a9ae5a55efb2e72ac3d80"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "25c45a06a150c8204ae4564dd31169897814c462cc0b81ed213e75166ad104ef0e8a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xee, 0x3, "4e05286ac28fa059c97f9a2d8857dc9cd84534c3dd67a0b8d84a0cefdd9da4e2dff552a79af512322c324d504a86e040b7acd2469b63e7b076a96995fc756d6fb3bc2654bcf6ca6020170a4abbbb1a96fa27e21db92ee172e488e6d6ad8666b9aa919017ffdb562e63700e1597fe979fb1aaca8dc03644462a50b5d9a6b60f94c20617e9864be4e92e4d7c26d7f53b26be108d9a0bcaaec4fefa88d8cb426cfe4591bd9883a84b60002cf107425a10f5bf9494044f88156f4ebf66aa6da151e18df6dca672681411d8886f490d7ad2050fcff8f749ce9047306e780dd3ddcfef23f1a8d1fa4d30ce5b08"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x2cc}}, 0x40010) ioctl$CDROMSTOP(r1, 0x5307) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sysvipc/msg\x00', 0x0, 0x0) ioctl$CDROMREADMODE1(r1, 0x530d, &(0x7f0000000440)={0x7e, 0x5, 0x3, 0x4, 0x9, 0x2}) mmap$IORING_OFF_SQ_RING(0x0, 0x3000, 0x1, 0x12, r3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYRESHEX=r3], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getnexthop={0x24, 0x6a, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4014}, 0x8040) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x20040000) executing program 8: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 6: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204441, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x4, 0x1c, [0x86, 0xc6fb, 0x2, 0x8, 0xffff, 0x8001, 0xd2b]}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x8, 0xd, 0x2}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x0, 0x10, 0x28, @loopback, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0x8, 0x0, 0x5}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x254, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xd0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x602}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '))\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '+:#]:^{,\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd990}, @ETHTOOL_A_BITSET_VALUE={0x52, 0x4, "c48c3b1ecd83ae6d926c4e769605e38ed11362a73088aae43386621cd8fb5dbc6f316de974d19b5bb20512ea350fd0765e53e19ce71d8e3a3ab5c50b07b2a9e61479fd97c3e95196386e868d7bc6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_VALUE={0x96, 0x4, "fb4a3dac77735041db4a035116940b893348c64261d6055424fe137ad91fa6cf0a91ef9764f29e1bb72dad61a4a09080892b20764f819901b14de30f3fb7ca40f67ad0bd2e5fd1c37d86c79e1acea352091ee6aa97e45479884397d21203e1be44c61d122c64127d801c25d27cdc01bf18d65145d9967e4b1ebffddb9fb02b48db2046a76c4480820f20dbf61d702796a017"}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\\\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000005c0)) write$cgroup_subtree(r0, &(0x7f0000000600)={[{0x2b, 'rdma'}, {0x3b, 'cpu'}]}, 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x6c, r5, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1a7, 0x16}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x10}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x4]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x9f5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x200}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x38}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x4000) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000800)=0x1, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f0000000840)={'syztnl0\x00', r3, 0x10, 0x7800, 0x8, 0x1, {{0x12, 0x4, 0x2, 0x6, 0x48, 0x64, 0x0, 0xfc, 0x29, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x24, 0xf8, 0x0, 0x3, [0x1, 0xca91, 0xff, 0x2, 0x4, 0x0, 0x400, 0x6]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x4, 0x79, 0x3, 0x9}, @end, @ra={0x94, 0x4, 0x1}]}}}}}) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000900)=0x983b, &(0x7f0000000940)=0x2) r7 = accept4$bt_l2cap(r0, &(0x7f0000000980), &(0x7f00000009c0)=0xe, 0x80000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000a00)={0x2, 'veth1\x00', {0x9}, 0x9}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) ioctl$UI_GET_SYSNAME(r8, 0x8040552c, &(0x7f0000000a80)) getsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r9, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bind$inet(r8, &(0x7f0000000c40)={0x2, 0x4e20, @remote}, 0x10) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0xac, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8014}, 0x20000800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000e00)={0xe, 0x14, [0x8d84, 0x9, 0xffffffff, 0xd, 0x10]}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) r10 = openat$null(0xffffffffffffff9c, &(0x7f0000000ec0), 0x204000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r10, 0x84, 0x1b, &(0x7f0000000f00)={0x0, 0xe4, "2d49b43fa2f1f5a74c17301b9d137a34e4c10785ad2bec3b418fa72d97855a3557ec3ee64e1fb1c338d9b5fd8442b178ce668aaf4be20897c72f4b583f632f46df5edcd13db4147c0515467335ec03507055863a7344c795f827eb0b0c523638bc51e132ed7859ef4781474d082b672728077947409363ce2394cc9e0b83c4ac95fee850d3f0d43c56664b51b2672dbd46095514e55e661efc962d5fca6b9507fe35611facb9eb03525f81e16dbbe075631510314ab2c4ee6fbedccb5cf04e33704f0c66027730106ea743551469b286d0cd9625596a9df2ade1f34fe2913305d12688f2"}, &(0x7f0000001000)=0xec) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f0000001180)={&(0x7f0000001040), 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x4}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x7}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8095}, 0x2004c085) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 16) executing program 6: unshare(0x60040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000300000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program crashed: KASAN: slab-use-after-free Write in snd_usb_midi_v2_free bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 29, 7, 5, 20, 3, 2, 9, 11, 13, 18, 30, 13, 4, 12, 15, 13, 2, 20] detailed listing: executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="340000001400b595feffbfff000800000a0066fe", @ANYRES32, @ANYBLOB="14000200"], 0x34}, 0x1, 0x0, 0x0, 0x9eff}, 0x0) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400000000a882, 0x0) r4 = dup(r3) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x39) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r7, 0xaea3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1f7) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x0, &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000680)='dummy_udc.0', 0xb) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r4, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000000c0)) mprotect(&(0x7f00006ee000/0x3000)=nil, 0x3000, 0xa) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002000010027bd7200fddbdf250a0020400000000708000000080017004e244e2414000200fe8000000000000000000000000000173a4f7278c1c7bcec210bcbcc000cae4b5f24f08dd8bf820e9c73bffb73fb516ed5b271a2f67a7dcbcaa609fc9d540fa33d69718549daa7a86230c5743b2218e5cba1b21903cd7f54529460203fd67c18ace49ba7b58b1a46555748951d85e7156def55da42ba855087a3b8525277e05b4ba93765c2e0c4c2b1b9212beb43d7659ce5f1284264393d9387a9975cf01ff7a3d46ec6a588bfe1122fe911005eced6a5d1e095"], 0x38}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc601}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="034886dd09032800050030000300600000000228290081e949b93897bc3b0000000000007d01ff020000002900000000000000000001"], 0xfdef) executing program 7: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2008c040}, 0x0) mkdir(&(0x7f0000000000)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100800112010002000000400000f0ffff0000000001", 0x1f) executing program 7: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000007c0)={0x28, 0x6, r3, 0x0, &(0x7f0000ff5000/0x1000)=nil, 0x1000, 0x1020800}) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000440)={0x28, 0x2, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000400)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000000c0)={0x28, 0x3, r4, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000080)}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/firmware/timeout\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='60\x00', 0x3) close(r6) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80c, 0x20}) executing program 8: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0xffb0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 6: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000013005f0214f9f407000982001f000000fe0000000000000008000f00fd00f000", 0x24) executing program 8: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x2a, 0x8, 0x4, 0x7, 0x7, 0xc0, 0x1, 0x3, 0x5, 0xdf, [0x80, 0x0, 0x32, 0x7, 0x0, 0xa0, 0x10, 0x5]}}) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001000010001000000ffdbdf2100000000", @ANYRES32=r2, @ANYBLOB="850b010000ffc300140003006d6163736563300000000000000000000a000100aa"], 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) executing program 6: r0 = socket(0x10, 0x3, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000000c0), 0x86000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000001200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000000ec0)={0x2cc, r2, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf01}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7c}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x656}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe5ed}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvtap0\x00'}}]}, @TIPC_NLA_NODE={0x1a4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "fdc9dc06e28d69bd7edd2dc083c591a9ea5271c3c274fb0a9ae5a55efb2e72ac3d80"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "25c45a06a150c8204ae4564dd31169897814c462cc0b81ed213e75166ad104ef0e8a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xee, 0x3, "4e05286ac28fa059c97f9a2d8857dc9cd84534c3dd67a0b8d84a0cefdd9da4e2dff552a79af512322c324d504a86e040b7acd2469b63e7b076a96995fc756d6fb3bc2654bcf6ca6020170a4abbbb1a96fa27e21db92ee172e488e6d6ad8666b9aa919017ffdb562e63700e1597fe979fb1aaca8dc03644462a50b5d9a6b60f94c20617e9864be4e92e4d7c26d7f53b26be108d9a0bcaaec4fefa88d8cb426cfe4591bd9883a84b60002cf107425a10f5bf9494044f88156f4ebf66aa6da151e18df6dca672681411d8886f490d7ad2050fcff8f749ce9047306e780dd3ddcfef23f1a8d1fa4d30ce5b08"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x2cc}}, 0x40010) ioctl$CDROMSTOP(r1, 0x5307) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sysvipc/msg\x00', 0x0, 0x0) ioctl$CDROMREADMODE1(r1, 0x530d, &(0x7f0000000440)={0x7e, 0x5, 0x3, 0x4, 0x9, 0x2}) mmap$IORING_OFF_SQ_RING(0x0, 0x3000, 0x1, 0x12, r3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYRESHEX=r3], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getnexthop={0x24, 0x6a, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NHA_GROUPS={0x4}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4014}, 0x8040) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x20040000) executing program 8: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 6: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204441, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x4, 0x1c, [0x86, 0xc6fb, 0x2, 0x8, 0xffff, 0x8001, 0xd2b]}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x8, 0xd, 0x2}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x0, 0x10, 0x28, @loopback, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0x8, 0x0, 0x5}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x254, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xd0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x602}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '))\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '+:#]:^{,\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd990}, @ETHTOOL_A_BITSET_VALUE={0x52, 0x4, "c48c3b1ecd83ae6d926c4e769605e38ed11362a73088aae43386621cd8fb5dbc6f316de974d19b5bb20512ea350fd0765e53e19ce71d8e3a3ab5c50b07b2a9e61479fd97c3e95196386e868d7bc6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_VALUE={0x96, 0x4, "fb4a3dac77735041db4a035116940b893348c64261d6055424fe137ad91fa6cf0a91ef9764f29e1bb72dad61a4a09080892b20764f819901b14de30f3fb7ca40f67ad0bd2e5fd1c37d86c79e1acea352091ee6aa97e45479884397d21203e1be44c61d122c64127d801c25d27cdc01bf18d65145d9967e4b1ebffddb9fb02b48db2046a76c4480820f20dbf61d702796a017"}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\\\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000005c0)) write$cgroup_subtree(r0, &(0x7f0000000600)={[{0x2b, 'rdma'}, {0x3b, 'cpu'}]}, 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x6c, r5, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1a7, 0x16}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x10}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x4]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x9f5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x200}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x38}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x4000) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000800)=0x1, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f0000000840)={'syztnl0\x00', r3, 0x10, 0x7800, 0x8, 0x1, {{0x12, 0x4, 0x2, 0x6, 0x48, 0x64, 0x0, 0xfc, 0x29, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x24, 0xf8, 0x0, 0x3, [0x1, 0xca91, 0xff, 0x2, 0x4, 0x0, 0x400, 0x6]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x4, 0x79, 0x3, 0x9}, @end, @ra={0x94, 0x4, 0x1}]}}}}}) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000900)=0x983b, &(0x7f0000000940)=0x2) r7 = accept4$bt_l2cap(r0, &(0x7f0000000980), &(0x7f00000009c0)=0xe, 0x80000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000a00)={0x2, 'veth1\x00', {0x9}, 0x9}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) ioctl$UI_GET_SYSNAME(r8, 0x8040552c, &(0x7f0000000a80)) getsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r9, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bind$inet(r8, &(0x7f0000000c40)={0x2, 0x4e20, @remote}, 0x10) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0xac, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8014}, 0x20000800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000e00)={0xe, 0x14, [0x8d84, 0x9, 0xffffffff, 0xd, 0x10]}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) r10 = openat$null(0xffffffffffffff9c, &(0x7f0000000ec0), 0x204000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r10, 0x84, 0x1b, &(0x7f0000000f00)={0x0, 0xe4, "2d49b43fa2f1f5a74c17301b9d137a34e4c10785ad2bec3b418fa72d97855a3557ec3ee64e1fb1c338d9b5fd8442b178ce668aaf4be20897c72f4b583f632f46df5edcd13db4147c0515467335ec03507055863a7344c795f827eb0b0c523638bc51e132ed7859ef4781474d082b672728077947409363ce2394cc9e0b83c4ac95fee850d3f0d43c56664b51b2672dbd46095514e55e661efc962d5fca6b9507fe35611facb9eb03525f81e16dbbe075631510314ab2c4ee6fbedccb5cf04e33704f0c66027730106ea743551469b286d0cd9625596a9df2ade1f34fe2913305d12688f2"}, &(0x7f0000001000)=0xec) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f0000001180)={&(0x7f0000001040), 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x4}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x7}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8095}, 0x2004c085) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 16) executing program 6: unshare(0x60040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000300000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program crashed: general protection fault in dummy_udc_start bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-prctl$PR_SET_VMA-openat-write-openat-write-landlock_create_ruleset-openat$dir-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-close-symlinkat detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') program did not crash bisect: split chunks (needed=true): <18> bisect: split chunk #0 of len 18 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 18, 30, 13, 4, 12, 15, 13, 2, 20] detailed listing: executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x20040000) executing program 8: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_read_local_pairing_opts={{0x4}, {0x69, 0x8}}}}, 0x9) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x2000800) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) executing program 6: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204441, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x4, 0x1c, [0x86, 0xc6fb, 0x2, 0x8, 0xffff, 0x8001, 0xd2b]}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x8, 0xd, 0x2}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x29, 0x1, 0x0, 0x10, 0x28, @loopback, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0x8, 0x0, 0x5}}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x254, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xd0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x602}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '))\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '/dev/vsock\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '+:#]:^{,\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xd990}, @ETHTOOL_A_BITSET_VALUE={0x52, 0x4, "c48c3b1ecd83ae6d926c4e769605e38ed11362a73088aae43386621cd8fb5dbc6f316de974d19b5bb20512ea350fd0765e53e19ce71d8e3a3ab5c50b07b2a9e61479fd97c3e95196386e868d7bc6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_MSGMASK={0xe0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_VALUE={0x96, 0x4, "fb4a3dac77735041db4a035116940b893348c64261d6055424fe137ad91fa6cf0a91ef9764f29e1bb72dad61a4a09080892b20764f819901b14de30f3fb7ca40f67ad0bd2e5fd1c37d86c79e1acea352091ee6aa97e45479884397d21203e1be44c61d122c64127d801c25d27cdc01bf18d65145d9967e4b1ebffddb9fb02b48db2046a76c4480820f20dbf61d702796a017"}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\\\x00'}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f00000005c0)) write$cgroup_subtree(r0, &(0x7f0000000600)={[{0x2b, 'rdma'}, {0x3b, 'cpu'}]}, 0xb) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x6c, r5, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1a7, 0x16}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x10}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x4]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x9f5}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x200}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x38}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x41}, 0x4000) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000800)=0x1, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f0000000840)={'syztnl0\x00', r3, 0x10, 0x7800, 0x8, 0x1, {{0x12, 0x4, 0x2, 0x6, 0x48, 0x64, 0x0, 0xfc, 0x29, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x24, 0xf8, 0x0, 0x3, [0x1, 0xca91, 0xff, 0x2, 0x4, 0x0, 0x400, 0x6]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x4, 0x79, 0x3, 0x9}, @end, @ra={0x94, 0x4, 0x1}]}}}}}) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000900)=0x983b, &(0x7f0000000940)=0x2) r7 = accept4$bt_l2cap(r0, &(0x7f0000000980), &(0x7f00000009c0)=0xe, 0x80000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000000a00)={0x2, 'veth1\x00', {0x9}, 0x9}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) ioctl$UI_GET_SYSNAME(r8, 0x8040552c, &(0x7f0000000a80)) getsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r9, &(0x7f0000000c00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bind$inet(r8, &(0x7f0000000c40)={0x2, 0x4e20, @remote}, 0x10) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0xac, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8014}, 0x20000800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000e00)={0xe, 0x14, [0x8d84, 0x9, 0xffffffff, 0xd, 0x10]}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) r10 = openat$null(0xffffffffffffff9c, &(0x7f0000000ec0), 0x204000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r10, 0x84, 0x1b, &(0x7f0000000f00)={0x0, 0xe4, "2d49b43fa2f1f5a74c17301b9d137a34e4c10785ad2bec3b418fa72d97855a3557ec3ee64e1fb1c338d9b5fd8442b178ce668aaf4be20897c72f4b583f632f46df5edcd13db4147c0515467335ec03507055863a7344c795f827eb0b0c523638bc51e132ed7859ef4781474d082b672728077947409363ce2394cc9e0b83c4ac95fee850d3f0d43c56664b51b2672dbd46095514e55e661efc962d5fca6b9507fe35611facb9eb03525f81e16dbbe075631510314ab2c4ee6fbedccb5cf04e33704f0c66027730106ea743551469b286d0cd9625596a9df2ade1f34fe2913305d12688f2"}, &(0x7f0000001000)=0xec) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f0000001180)={&(0x7f0000001040), 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x4}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x7}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8095}, 0x2004c085) executing program 8: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 16) executing program 6: unshare(0x60040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000300000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1}, 0x0) executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program crashed: general protection fault in dummy_udc_start bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <9> bisect: split chunk #0 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 15, 13, 2, 20] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program crashed: general protection fault in dummy_udc_start bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 2, 20] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=ANY=[@ANYBLOB="140000001000010000000000000100000700000a90010000060a0b0400000000000000000200f5ff64010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d0bbb467af360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x10}, 0x24000800) executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000000080)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0xc51dd000) r2 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002340)=0x14, 0x80000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000002380)=0x9, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r5, 0xaece) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000, 0x9ac42000}, 0x700) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 15, 13] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) program crashed: general protection fault in dummy_udc_start bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 13] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 1: bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) syz_open_dev$cec(&(0x7f00000004c0), 0x0, 0x80480) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd26, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x900, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 15] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) symlinkat(&(0x7f0000000140)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', r3, &(0x7f0000000180)='./mysys/file0\x00') executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) close(r3) (async) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000200)={0x100, r3}, 0x0) (async) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in set_link_state testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in set_link_state testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) (async, rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000040)='\x00') (async) write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 15] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 15] detailed listing: executing program 0: mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 8: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) program did not crash minimized 12 calls -> 5 calls minimizing program #1 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) socket$pppl2tp(0x18, 0x1, 0x1) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 13] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) socket$pppl2tp(0x18, 0x1, 0x1) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20980, 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) socket$pppl2tp(0x18, 0x1, 0x1) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000270009002dbd7000fedbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) socket$nl_generic(0x10, 0x3, 0x10) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_elf64(r0, 0x0, 0x78) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 4] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 3] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) socket$inet(0xa, 0x801, 0x84) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 1] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: unshare(0x62040200) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 1] detailed listing: executing program 7: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) executing program 0: syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program crashed: general protection fault in dummy_udc_start minimized 15 calls -> 1 calls testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$dir-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program crashed: general protection fault in dummy_udc_start bisect: concatenation succeeded found reproducer with 6 syscalls minimizing guilty program testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$dir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x190) (rerun: 32) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program crashed: general protection fault in set_link_state testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-syz_usb_connect detailed listing: executing program 0: mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) (async) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program crashed: general protection fault in dummy_udc_start testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200), 0x0) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000084a48e08d112"], 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, 0x0, 0x0) program did not crash testing program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) program crashed: general protection fault in dummy_udc_start extracting C reproducer testing compiled C program (duration=50.208065302s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in set_link_state simplifying C reproducer testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing compiled C program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect program crashed: general protection fault in dummy_udc_start testing program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) program crashed: general protection fault in dummy_udc_start validation run: crashed=true testing program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) program crashed: general protection fault in dummy_udc_start validation run: crashed=true testing program (duration=50.208065302s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) syz_usb_connect(0x2, 0x56, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) program crashed: general protection fault in dummy_udc_start validation run: crashed=true reproducing took 1h3m29.502664732s repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5908 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:dummy_udc_start+0x91/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1022 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 RSP: 0018:ffffc90003847b48 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88802bef8c00 RCX: ffffffff87d0e079 RDX: 0000000000000000 RSI: ffffffff87d0e087 RDI: ffff88802bef9290 RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000005 R10: 0000000000000002 R11: 0000000000000000 R12: ffff888034934050 R13: 0000000000000000 R14: ffff88802d6574f1 R15: ffff88802d657008 FS: 0000555593269500(0000) GS:ffff8880d5eda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8041b87640 CR3: 00000000557f2000 CR4: 0000000000352ef0 Call Trace: usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline] gadget_bind_driver+0x4ac/0xbf0 drivers/usb/gadget/udc/core.c:1667 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline] raw_ioctl+0x1a85/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1307 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8041b9dcab Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffe1742e5e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f8041b9dcab RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 RBP: 00007ffe1742f6b0 R08: 0000000000000001 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000200000000100 R14: 0000000000000002 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dummy_udc_start+0x91/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1022 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 RSP: 0018:ffffc90003847b48 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88802bef8c00 RCX: ffffffff87d0e079 RDX: 0000000000000000 RSI: ffffffff87d0e087 RDI: ffff88802bef9290 RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000005 R10: 0000000000000002 R11: 0000000000000000 R12: ffff888034934050 R13: 0000000000000000 R14: ffff88802d6574f1 R15: ffff88802d657008 FS: 0000555593269500(0000) GS:ffff8880d5eda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8041b87640 CR3: 00000000557f2000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: df 48 89 fisttps -0x77(%rax) 3: fa cli 4: 48 c1 ea 03 shr $0x3,%rdx 8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) c: 0f 85 28 01 00 00 jne 0x13a 12: 4c 8b ab 90 06 00 00 mov 0x690(%rbx),%r13 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 4c 89 ea mov %r13,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 10 01 00 00 jne 0x144 34: 83 ed 01 sub $0x1,%ebp 37: bf 02 00 00 00 mov $0x2,%edi 3c: 49 8b 5d 00 mov 0x0(%r13),%rbx final repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5908 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:dummy_udc_start+0x91/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1022 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 RSP: 0018:ffffc90003847b48 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88802bef8c00 RCX: ffffffff87d0e079 RDX: 0000000000000000 RSI: ffffffff87d0e087 RDI: ffff88802bef9290 RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000005 R10: 0000000000000002 R11: 0000000000000000 R12: ffff888034934050 R13: 0000000000000000 R14: ffff88802d6574f1 R15: ffff88802d657008 FS: 0000555593269500(0000) GS:ffff8880d5eda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8041b87640 CR3: 00000000557f2000 CR4: 0000000000352ef0 Call Trace: usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline] gadget_bind_driver+0x4ac/0xbf0 drivers/usb/gadget/udc/core.c:1667 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline] raw_ioctl+0x1a85/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1307 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8041b9dcab Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffe1742e5e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f8041b9dcab RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 RBP: 00007ffe1742f6b0 R08: 0000000000000001 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000200000000100 R14: 0000000000000002 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dummy_udc_start+0x91/0x1d0 drivers/usb/gadget/udc/dummy_hcd.c:1022 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 RSP: 0018:ffffc90003847b48 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88802bef8c00 RCX: ffffffff87d0e079 RDX: 0000000000000000 RSI: ffffffff87d0e087 RDI: ffff88802bef9290 RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000005 R10: 0000000000000002 R11: 0000000000000000 R12: ffff888034934050 R13: 0000000000000000 R14: ffff88802d6574f1 R15: ffff88802d657008 FS: 0000555593269500(0000) GS:ffff8880d5eda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8041b87640 CR3: 00000000557f2000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: df 48 89 fisttps -0x77(%rax) 3: fa cli 4: 48 c1 ea 03 shr $0x3,%rdx 8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) c: 0f 85 28 01 00 00 jne 0x13a 12: 4c 8b ab 90 06 00 00 mov 0x690(%rbx),%r13 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 4c 89 ea mov %r13,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 10 01 00 00 jne 0x144 34: 83 ed 01 sub $0x1,%ebp 37: bf 02 00 00 00 mov $0x2,%edi 3c: 49 8b 5d 00 mov 0x0(%r13),%rbx