Extracting prog: 16m16.733058752s Minimizing prog: 12m14.177759859s Simplifying prog options: 0s Extracting C: 37.724630581s Simplifying C: 7m21.46653393s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket-socket$netlink-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$unix-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xfff2}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004805d}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETIFF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETIFF-ioctl$TUNSETIFF detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$kcm-openat$tun-close-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-socket$unix-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$kcm detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'syzkaller0\x00'}) sendmsg$kcm(r1, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-setxattr$security_ima detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) setxattr$security_ima(&(0x7f0000000000)='./sys/bus/pnp/devices/00:02/resources\x00', &(0x7f0000000040), &(0x7f0000000080)=@v2={0x5, 0x1, 0xc, 0x3}, 0x9, 0x2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-setxattr$security_ima detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) setxattr$security_ima(&(0x7f0000000000)='./sys/bus/pnp/devices/00:02/resources\x00', &(0x7f0000000040), &(0x7f0000000080)=@v2={0x5, 0x1, 0xc, 0x3}, 0x9, 0x2) program did not crash single: failed to extract reproducer bisect: bisecting 37 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 8, 14, 12, 7, 3, 3, 4, 4, 3, 18, 23, 8, 1, 7, 14, 5, 7, 4, 8, 9, 13, 5, 2, 8, 7, 13, 4, 13, 2, 8, 7, 3, 8, 2, 5, 11] detailed listing: executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001880)) r2 = eventfd2(0x1, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, &(0x7f0000010000), &(0x7f0000020000), 0x0}) write(r1, &(0x7f0000018000)="000001", 0x3) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000600)={0x1, r1}) write$tun(r1, &(0x7f0000000800)=ANY=[], 0x10) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='100', 0x3) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="6c0000001800050604000000000000000a400000fe040001000000001400010020010db800c0000000000000000000010c00080008000200dc05000008000400010000000600150003000000200016800c0001001234567890abcdef0500", 0x5e) unshare(0x62040200) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000640)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000780)="e869b4c8de", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000800)="0f812ed6a7f2a3a76c196cbd8e7bdee0c3f61bc5a31e9483f6cad55ab536d2ffae7a72f5f0ca19394a5210b00560d560df167616e756286d14bef0e1b4e4835889d525f1756a62cedb7e3dcae43360b7434338ebdb859ea346faa83d564651a516849524932a5011162d3bd40a6c2279bda58ef479a98bbe14434384ea4e5227a1ffb86eba95f46fb279ace73a334e74f08830449f2382cb2c60", 0x9a}, {&(0x7f00000008c0)="540aa3d5e1a861b02ea392d351655e89091a33c5447ec796a214172785ffe0dfab", 0x21}, {&(0x7f0000000900)="8bb303bb5bf1f4943da21c402f544de0a5f772f0d8c06a5f60b8a18ecaf906571caefe89e7a332", 0x27}, {&(0x7f0000000940)="135979d5553b6190ee802c99f43b081320ac32875e1070335278f56c34891da7916cc9f2458fcb586d1e4e50a955bbc5618fa823a29f5cc85512f218c9574c3a4b5382056e04168ea480e0674a64d7877aff2b339047e4b7c6d2ef9c2580c6a9b3dc078481f802760d81e064e290b6205d556bfbd79173c656b65e1eeb61e3091e2cef32473e22764bede62295dcb9a0fad0317c7083d9fe1329a629a3d877fa6bd796295026bb0d21ecc0cec4a9757112d46dcd0d58bb54f1a58d1817c268f2a548421a1d2a43fad7f50e9d5a2312d3cabbada7b672bd434f7575cd1fcb6b14cf90b46d5da40445f5a447af86942e2a1bef7ed8593da3b3af385444876e9f8da03585f23e0da33e7709aeabef64b9e31efaca799df4642f847f93d84527901dc24cd4f467f67c848ddb92766c5ec3dbc68725bdc2ca73ec85d70724fb2d50d22fbfb5911262bad75240aa25813b815181bcc8e0958572c0f106d2a64cba2ab268b709ef34d6cb950cc72c8dad9ec4a71a1bb3a1930226d81dff2587d0fbfd74afd8344cbfceac3969744be115b5373ebf55ffeee0c2b1186716061f6ce7ec69a55ba5925b87faefe56a51133d62c859ae4f5befb3254cac828b4e8ea943e64055463425105091a7307744305e116aa648ec9ae831a2bf678d014620b4885ee6dd36de27645c01b1bdf90033e2620eefff1de2dc0e5d5d73008a99b661ff4015644f3ef2c8e16de753d3bb2071e7c984aef53f29c71fb604efa6ac407e41c9186c2815fe3ee2732cc62694aaffcb2671fd6e8d971cf3aa7f40e8cd860aaa01df1cf6db739e67c1e5dc5e9772845be5f161f9b9bce92f11b96139e3ddc59d5f94abfa911e1bf71661411da0c7e254ce4b5f9b3f6800a5091e0e02336117ca465514e40df8315f5b94f66b50cedd8bc05f0457fbd7eb1b96024b5b8c143961ef8391425b6df2f7505599487e5084446e6669d08e36da3f3fc0c1d4077794040c7b35b5d4dde7b59c592d63ef301e60634496c0410cb68417e75d8e952f92421a88d2381ee12754180b547424dbfc6d2859b60fb34faa3e5b15da6322a40b5a5d79c796473303ca6a7e5fc0595d60d77153e9d21c4b4b84365f8de0ebd2e2d9da6fcdf1105d530b1a8dfafe430763901494d41ad0cc71fb26c2a13cf4b3766bdff601b1dbeb3c20389f248798531b39d41ccf9acf34b0421b711e31a21fe123e98627e6ecf7c98c6e88c20fe4d3427f807e8e75742f1280279ae1d4f6e5ee72719097338fa75f7c2a96f9a0789fc0daa50cdc3aa2d0c3a44ce16bfe904cfc2e5eef1eb9e90e3aa5f3e942f6810e4fbab3713f5922f0f365b8415c6beeca0baff7d71e73c0c30ca5d54b87ee62b41658ac2697e85768e00e8eb95952eabf2c1cd5121cca0c00da63bd805ca970abe5c980daddd226ffa4d86d80215b9390c3e9d7ceb45ca10ed6a42d41802c776007d4b30bc92285fb594f76ed0aae4e03a04717c7991ef72d9cdc2b66d6d11049e44c80235b67d942ff1272a78e401ef88fc277f2cbb241352972ace3bba26fd716845bde14e48eea499a933829bd3efa535c4f396c0d8d97161e296e44da511407aaa8987b670fb41780915d2e6f5062150b97eda7a474b21185acedc1757ff6b115e46eff25cbab9a09fc6a7fc726834ac1b9c203b7ad4037858a293f037114a8e11fbfe9d776d33e4b5e542226", 0x4ba}], 0x4}}], 0x2, 0x2401c444) sendto$inet6(r1, &(0x7f0000000e00)="83e226b59a2e0eba0fa5d208", 0xc, 0x20008000, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0x5) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000240)={0x2001, r3}, 0x0) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r3, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = syz_pidfd_open(0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, 0x0) r1 = pidfd_getfd(r0, r0, 0x0) setns(r1, 0x66020000) umount2(0x0, 0x2) executing program 0: setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000008050000010b00"], 0x97) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) setxattr$security_ima(&(0x7f0000000000)='./sys/bus/pnp/devices/00:02/resources\x00', &(0x7f0000000040), &(0x7f0000000080)=@v2={0x5, 0x1, 0xc, 0x3}, 0x9, 0x2) executing program 32: mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) setxattr$security_ima(&(0x7f0000000000)='./sys/bus/pnp/devices/00:02/resources\x00', &(0x7f0000000040), &(0x7f0000000080)=@v2={0x5, 0x1, 0xc, 0x3}, 0x9, 0x2) executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x80, r1, 0x5, 0x0, 0x3, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x46, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x0, @random=0x2, 0x1, @void, @void, @val={0x3, 0x1, 0x2}, @void, @void, @val={0x5, 0x3, {0x2, 0x86, 0xa2}}, @val={0x25, 0x3, {0x1, 0x78, 0x3}}, @void, @void, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xff, 0x0, 0x1, 0x7, 0x29}}, @val={0x76, 0x6, {0x60, 0x6, 0x41, 0x101}}}}, @NL80211_ATTR_IE_PROBE_RESP={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1000}]}, 0x80}}, 0x39db77225c63fa4c) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net\x00') r1 = openat(r0, &(0x7f00000000c0)='can/rcvlist_eff\x00', 0x0, 0x0) read(r1, &(0x7f0000000100), 0x1000) executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) quotactl$Q_GETNEXTQUOTA(0xffffffff80000900, &(0x7f0000000000)=@filename='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='of', 0x8) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) socket$inet6_mptcp(0xa, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x80, &(0x7f0000000840)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f0000002080)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f00000040c0)={0x50, 0x0, r3, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000004140)='./file0\x00', 0x40000, 0x73) syz_fuse_handle_req(r2, &(0x7f0000004180)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000006180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006240)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, &(0x7f0000006280)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13059b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895ca9bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e0179c6a9edd8e96663392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e538aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000008280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000008340)={0x150, 0x0, 0xfffffffffffffff9, [{{0x2, 0x3, 0x7, 0x8002, 0xffffffcb, 0x7, {0x5, 0xe8eb, 0x5, 0x3659, 0x4, 0x6, 0x4, 0xfffffffa, 0x8, 0x1000, 0x8, r4, 0x0, 0x80, 0x2}}, {0x6, 0x0, 0x2, 0x8, ':\''}}, {{0x2, 0x0, 0x5, 0x0, 0x8, 0x0, {0x0, 0x7, 0x4, 0x7, 0x101, 0xff, 0x8001, 0xfffffffe, 0x39, 0x2000, 0x5, 0x0, 0x0, 0xffffff2e, 0x1}}, {0x3, 0x81, 0x2, 0x0, ':\''}}]}, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, 0x0, 0x0, 0x0) getdents64(r5, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/module/hid_cougar/parameters/g6_is_space\x00', 0x2, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000400)=ANY=[@ANYBLOB='y'], 0x24) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000002ec0)={&(0x7f0000002f00)={0x1c, 0x8, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) r2 = socket(0x1e, 0x4, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x44, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f0000000640)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x7, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x4]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f00000006c0)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f0000000740)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f00000007c0)={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0x0, 0x0, 0x1, 0x89f, 0x8, 0x1]}}, 0x5c) setsockopt$MRT6_FLUSH(r6, 0x29, 0xd4, &(0x7f0000000840)=0x6, 0x4) mount(&(0x7f00000005c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000880)='./cgroup\x00', &(0x7f00000008c0)='udf\x00', 0x1208000, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000000)=@req={0x82, 0x57b3, 0x3, 0x9}, 0x10) recvfrom$inet_nvme(r2, &(0x7f0000000040)=""/18, 0x12, 0x40000020, 0x0, 0x0) sendmsg$NL80211_CMD_SET_MAC_ACL(r2, 0x0, 0x24008004) recvmmsg$unix(r2, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/27, 0x1b}], 0x1}}], 0x40000000000007f, 0x0, 0x0) sendmmsg(r2, &(0x7f0000000140)=[{{0x0, 0xa9cc7003, &(0x7f0000000180)=[{&(0x7f00000001c0)="ee", 0x101d0}], 0x1}}], 0x3467028987bc7b9, 0x9200000000000000) executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000480), 0x123080) read(r0, &(0x7f0000000600)=""/83, 0x53) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000004c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000500), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000540)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) r2 = landlock_create_ruleset(&(0x7f0000000440)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0xa) executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) executing program 2: socket$packet(0x11, 0x3, 0x300) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0, 0x42}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 2: openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000), 0x0) sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000100)="96", 0x1}], 0x1}, 0x4048042) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000140)={'lo\x00', 0x3}) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f00000001c0)={0x7, 0x1b, 0x2}, 0xffffff9a) r4 = socket$inet_udp(0x2, 0x2, 0x0) write$sequencer(r1, &(0x7f0000000200)=[@n={0x3, 0xff, @SEQ_NOTEON=@note=0x65, 0x2}], 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000280)={@empty, @dev={0xac, 0x14, 0x14, 0x23}, 0xb, 0x20}}) write$cgroup_int(r1, &(0x7f00000002c0)=0x4, 0x12) splice(r2, 0x0, r0, 0x0, 0xffff, 0x2) executing program 1: r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r2, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 3: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xb, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x1a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="03031b003000320006006300000000442f"], 0x76) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x44, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) executing program 3: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000240)={0x2001, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 4: socket$kcm(0xa, 0x2, 0x73) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000500)={'bond_slave_0\x00', 0x800}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/devices/usb2/power/autosuspend_delay_ms\x00', 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x173) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='10', 0x2) getdents64(r1, &(0x7f00000005c0)=""/4096, 0x1000) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[], 0x70) write$binfmt_format(r0, &(0x7f0000000540)='-1\x00', 0x3) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x80, r1, 0x5, 0x0, 0x3, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x46, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x0, @random=0x2, 0x1, @void, @void, @val={0x3, 0x1, 0x2}, @void, @void, @val={0x5, 0x3, {0x2, 0x86, 0xa2}}, @val={0x25, 0x3, {0x1, 0x78, 0x3}}, @void, @void, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xff, 0x0, 0x1, 0x7, 0x29}}, @val={0x76, 0x6, {0x60, 0x6, 0x41, 0x101}}}}, @NL80211_ATTR_IE_PROBE_RESP={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1000}]}, 0x80}}, 0x39db77225c63fa4c) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'syzkaller0\x00'}) sendmsg$kcm(r1, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) executing program 4: r0 = syz_open_dev$usbmon(&(0x7f0000000380), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r1, &(0x7f0000000100)='100', 0x3) ioctl$BLKSECDISCARD(0xffffffffffffffff, 0x127d, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x94d72) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net\x00') r1 = openat(r0, &(0x7f00000000c0)='can/rcvlist_eff\x00', 0x0, 0x0) read(r1, &(0x7f0000000100), 0x1000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 4: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xfff2}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004805d}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) program crashed: kernel BUG in svc_destroy bisect: bisecting 37 programs bisect: split chunks (needed=false): <37> bisect: split chunk #0 of len 37 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 7, 14, 5, 7, 4, 8, 9, 13, 5, 2, 8, 7, 13, 4, 13, 2, 8, 7, 3, 8, 2, 5, 11] detailed listing: executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) executing program 2: socket$packet(0x11, 0x3, 0x300) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0, 0x42}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 2: openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000), 0x0) sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000100)="96", 0x1}], 0x1}, 0x4048042) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000140)={'lo\x00', 0x3}) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f00000001c0)={0x7, 0x1b, 0x2}, 0xffffff9a) r4 = socket$inet_udp(0x2, 0x2, 0x0) write$sequencer(r1, &(0x7f0000000200)=[@n={0x3, 0xff, @SEQ_NOTEON=@note=0x65, 0x2}], 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000280)={@empty, @dev={0xac, 0x14, 0x14, 0x23}, 0xb, 0x20}}) write$cgroup_int(r1, &(0x7f00000002c0)=0x4, 0x12) splice(r2, 0x0, r0, 0x0, 0xffff, 0x2) executing program 1: r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r2, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 3: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xb, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x1a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="03031b003000320006006300000000442f"], 0x76) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x44, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) executing program 3: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000240)={0x2001, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 4: socket$kcm(0xa, 0x2, 0x73) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000500)={'bond_slave_0\x00', 0x800}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/devices/usb2/power/autosuspend_delay_ms\x00', 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x173) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='10', 0x2) getdents64(r1, &(0x7f00000005c0)=""/4096, 0x1000) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[], 0x70) write$binfmt_format(r0, &(0x7f0000000540)='-1\x00', 0x3) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x80, r1, 0x5, 0x0, 0x3, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x46, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x0, @random=0x2, 0x1, @void, @void, @val={0x3, 0x1, 0x2}, @void, @void, @val={0x5, 0x3, {0x2, 0x86, 0xa2}}, @val={0x25, 0x3, {0x1, 0x78, 0x3}}, @void, @void, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xff, 0x0, 0x1, 0x7, 0x29}}, @val={0x76, 0x6, {0x60, 0x6, 0x41, 0x101}}}}, @NL80211_ATTR_IE_PROBE_RESP={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1000}]}, 0x80}}, 0x39db77225c63fa4c) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'syzkaller0\x00'}) sendmsg$kcm(r1, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) executing program 4: r0 = syz_open_dev$usbmon(&(0x7f0000000380), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r1, &(0x7f0000000100)='100', 0x3) ioctl$BLKSECDISCARD(0xffffffffffffffff, 0x127d, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x94d72) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net\x00') r1 = openat(r0, &(0x7f00000000c0)='can/rcvlist_eff\x00', 0x0, 0x0) read(r1, &(0x7f0000000100), 0x1000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 4: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xfff2}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004805d}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 4, 13, 2, 8, 7, 3, 8, 2, 5, 11] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/devices/usb2/power/autosuspend_delay_ms\x00', 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x173) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='10', 0x2) getdents64(r1, &(0x7f00000005c0)=""/4096, 0x1000) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[], 0x70) write$binfmt_format(r0, &(0x7f0000000540)='-1\x00', 0x3) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x80, r1, 0x5, 0x0, 0x3, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x46, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x0, @random=0x2, 0x1, @void, @void, @val={0x3, 0x1, 0x2}, @void, @void, @val={0x5, 0x3, {0x2, 0x86, 0xa2}}, @val={0x25, 0x3, {0x1, 0x78, 0x3}}, @void, @void, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xff, 0x0, 0x1, 0x7, 0x29}}, @val={0x76, 0x6, {0x60, 0x6, 0x41, 0x101}}}}, @NL80211_ATTR_IE_PROBE_RESP={0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1000}]}, 0x80}}, 0x39db77225c63fa4c) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'syzkaller0\x00'}) sendmsg$kcm(r1, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r4, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 3: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) executing program 4: r0 = syz_open_dev$usbmon(&(0x7f0000000380), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x802, 0x165) write(r1, &(0x7f0000000100)='100', 0x3) ioctl$BLKSECDISCARD(0xffffffffffffffff, 0x127d, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x94d72) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net\x00') r1 = openat(r0, &(0x7f00000000c0)='can/rcvlist_eff\x00', 0x0, 0x0) read(r1, &(0x7f0000000100), 0x1000) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 4: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xfff2}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004805d}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 7, 14, 5, 7, 4, 8, 9, 13, 5, 2, 8, 7] detailed listing: executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) executing program 2: socket$packet(0x11, 0x3, 0x300) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff4000/0x9000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x0, 0x42}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 2: openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000), 0x0) sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000100)="96", 0x1}], 0x1}, 0x4048042) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000140)={'lo\x00', 0x3}) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f00000001c0)={0x7, 0x1b, 0x2}, 0xffffff9a) r4 = socket$inet_udp(0x2, 0x2, 0x0) write$sequencer(r1, &(0x7f0000000200)=[@n={0x3, 0xff, @SEQ_NOTEON=@note=0x65, 0x2}], 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000280)={@empty, @dev={0xac, 0x14, 0x14, 0x23}, 0xb, 0x20}}) write$cgroup_int(r1, &(0x7f00000002c0)=0x4, 0x12) splice(r2, 0x0, r0, 0x0, 0xffff, 0x2) executing program 1: r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x5}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f00000004c0)=@xdp={0x2c, 0x7, r2, 0x3e}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000580)="03", 0x1}], 0x1}, 0x20004014) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x181000, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r1, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000640)={'nicvf0\x00', 0x1432}) executing program 3: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0xfff1, 0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0xd4, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x8, 0x6, 0x9, 0xc000, 0x4c16, 0x8, 0x7ff, 0x5, [{0x6, 0x1009}, {0x3ff, 0x0, 0xfffffff7, 0x81}, {0x4, 0x1000, 0xe6f, 0x5}, {0x8001, 0xfb86, 0xffffffff, 0x1ff}, {0x6, 0x2009, 0x2, 0x9}, {0x400, 0x5, 0xe, 0x1}, {0x80000000, 0x0, 0x1, 0x7f}, {0xfffffff9, 0x5, 0x9, 0x4}, {0x6, 0x2, 0x8, 0x3}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24004800}, 0x410c0) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="03031b0030003200060063"], 0x76) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xb, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x1a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="03031b003000320006006300000000442f"], 0x76) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x44, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) executing program 3: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000240)={0x2001, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 4: socket$kcm(0xa, 0x2, 0x73) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000500)={'bond_slave_0\x00', 0x800}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <13> bisect: split chunk #0 of len 13 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13, 5, 2, 8, 7] detailed listing: executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xb, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x1a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="03031b003000320006006300000000442f"], 0x76) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x44, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) executing program 3: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000240)={0x2001, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 4: socket$kcm(0xa, 0x2, 0x73) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000500)={'bond_slave_0\x00', 0x800}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 8, 7] detailed listing: executing program 3: r0 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000280)={0x0, 0x4, 0x2, 0x0, 0x5b}) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00') mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x2001}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x202000, 0x13b) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000240)={0x2001, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file2\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x0) executing program 4: socket$kcm(0xa, 0x2, 0x73) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000500)={'bond_slave_0\x00', 0x800}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000540)={'dvmrp1\x00', 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x80400, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f00000005c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'dvmrp0\x00', 0x102}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 13, 5] detailed listing: executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xb, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x6, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x1a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="03031b003000320006006300000000442f"], 0x76) executing program 5: r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x44, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) program crashed: kernel BUG in svc_destroy bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) program crashed: kernel BUG in svc_destroy bisect: concatenation succeeded found reproducer with 5 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: kernel BUG in svc_destroy testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2', 0x5) program crashed: kernel BUG in svc_destroy validation run: crashed=true reproducing took 39m32.063988283s repro crashed as (corrupted=false): ------------[ cut here ]------------ kernel BUG at net/sunrpc/svc.c:605! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4556 Comm: syz.0.18 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 sp : ffff800022207930 x29: ffff800022207930 x28: 1fffe0001ad18edf x27: ffff0000d94b0000 x26: dfff800000000000 x25: ffff700004440f2c x24: ffff800022207960 x23: ffff0000c8dd4a00 x22: dfff800000000000 x21: 0000000000000001 x20: ffff0000e928fc68 x19: ffff0000e928fc50 x18: 1fffe00033c1877e x17: ffff80001641d000 x16: ffff8000082dd38c x15: 000000000004ffff x14: 0000000000000001 x13: 1fffe00033c1caf0 x12: 0000000000000000 x11: ff00800010f42c78 x10: 0000000000000000 x9 : ffff800010f42c78 x8 : ffff0000d94b0000 x7 : ffff8000083bb394 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline] __write_ports fs/nfsd/nfsctl.c:794 [inline] write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114 vfs_write+0x2a8/0x7c8 fs/read_write.c:582 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: 91026260 97c2bb5f 17ffffc8 97c2baf1 (d4210000) ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ------------[ cut here ]------------ kernel BUG at net/sunrpc/svc.c:605! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4556 Comm: syz.0.18 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 sp : ffff800022207930 x29: ffff800022207930 x28: 1fffe0001ad18edf x27: ffff0000d94b0000 x26: dfff800000000000 x25: ffff700004440f2c x24: ffff800022207960 x23: ffff0000c8dd4a00 x22: dfff800000000000 x21: 0000000000000001 x20: ffff0000e928fc68 x19: ffff0000e928fc50 x18: 1fffe00033c1877e x17: ffff80001641d000 x16: ffff8000082dd38c x15: 000000000004ffff x14: 0000000000000001 x13: 1fffe00033c1caf0 x12: 0000000000000000 x11: ff00800010f42c78 x10: 0000000000000000 x9 : ffff800010f42c78 x8 : ffff0000d94b0000 x7 : ffff8000083bb394 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: svc_destroy+0x178/0x184 net/sunrpc/svc.c:605 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline] __write_ports fs/nfsd/nfsctl.c:794 [inline] write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114 vfs_write+0x2a8/0x7c8 fs/read_write.c:582 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: 91026260 97c2bb5f 17ffffc8 97c2baf1 (d4210000) ---[ end trace 0000000000000000 ]---