Extracting prog: 6m15.095047276s
Minimizing prog: 58m9.749950202s
Simplifying prog options: 0s
Extracting C: 51.275273617s
Simplifying C: 26m35.813333729s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL-mlock$auto-socket-select$auto
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
mlock$auto(0x749fd573, 0x204a)
socket(0x21, 0x2, 0x2)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xc, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x7, 0x62, 0x5, 0xa, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 21, 28, 15, 36, 36, 28, 30, 24, 30, 28, 10, 30, 27, 14, 30, 30, 30, 10, 9, 27, 6, 28, 25, 30, 7, 11, 2, 30, 6]
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
io_uring_setup$auto(0x4, 0x0)
open(0x0, 0x22240, 0x55)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000280)=""/65, 0x41)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x60280, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
socket(0x2, 0x2, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0x40e983, 0xdf, 0xeb1, r0, 0x8000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x801, 0x0)
mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1\x00', 0x201, 0x0)
ioctl$auto_SNDCTL_DSP_SUBDIVIDE(r1, 0xc0045009, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8400)
socket(0xa, 0x1, 0x100)
ioperm$auto(0x7, 0x5ad2, 0x8)
modify_ldt$auto(0x1, 0x0, 0x10)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r2 = openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/lru_gen\x00', 0xc0000, 0x0)
pread64$auto(r2, &(0x7f0000000040)='\x00\x00\x00\x88\xde\x90\a\'\x9bM\xa0\x848\xbbz(\xe9\x05<\x82\xfe\xe2\xf6 \x0f8\xfb\xa7\xb4\xa0\x9e\xcb\xec\x9e{W\xed>\xe7l\xcb\x90\\/\x84\x99!*\xe3\x99}x\xd4\xa5D\xfa\xe5\xf9od^\xa6', 0x7ff, 0x400)
socket(0x1e, 0x1, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
executing program 0:
r0 = semctl$auto(0x7, 0x5, 0x0, 0x6)
sendmsg$auto_NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800c000}, 0xc, &(0x7f0000000800)={&(0x7f0000000880)=ANY=[@ANYBLOB="80050000", @ANYRESDEC=r0, @ANYBLOB="02002bbd7000fcdbdf25010000000400e2000000002000328005000300020000000500030002000000040005000800040000000000000be24c183fde5b9d4eaa60152c220b90f9370ed909cb387efd44283302b1f53dcde4e9bc252c784fea90af25c968b063e49d0c7166e007d16e", @ANYRES16=r0, @ANYBLOB="040016010c005800ffffffffffffff7f080026000500000004002501d9037a80060149808cd61c31c5041e3424464242515cd9843760c4a39a368d664b128f2554d7cbe75a4ed046fd887eff7b32574b4b5f43f77902742753d16f8cae6e16ee3ebdc99be3105e30e0a2812c3dc9fd9e039a40e8a2d3921af6b7f0e94d0b9538d31bea5aa744a5d88edc35b2bebe8507d82640b10d604ff44e7d53938909443a6b488eb8333626626206c43d86718f7453c970e23e15746b94efd81be2055161b11a154c2edaddf4285e09eb67814e9b99e048cbf8542040974cf57a8e79e7c6ebe14451438a95c02c9b0ad5366a612db43d8bfafe3eabd566dc38beb2019168041f668cbf5b1ba2a150601294a397983d6d6954cdc26e53aa3ee4a0bab50400598004003880000076cd57077d979100e88004000f8004006680c42ee4df924ddc93213865b27ed9ea52124b6f809722a06c5f6ff07ea8d7704250714382bf6ede5bdccb943b5fa10ebf7cc7d3a7ccf3cfee5518c49154b9e2dfaf7939345a592e87087bef5cebd5b6bef6c4c642ac2ded2a82107fd38198b25878067a74fcc2cd819e17aba7fc3aa7b9b7df036839f0bfe3193f097b12980715876b0d8aa70000008eec09695a2bcbae14c9b59a553a7b46ac085400ab00d0c1e731c250b3b410b2eea09b64806ecc49c523b5710dcbb489f1e6dbc65603ef7d871f09108bc1454c6a40d085f9a38a46b82376c855b9eb065043f08746acfb023c7ad836d820f1e2413623578e9ac971995474316bf5e581beded228af85e750383cd60a5c4de9604c4ef8b06da0039ab2a44163307abffb14b5aef5674d9e218bb25c26bfa083b532c1fa3449c688d2072559a56bc127dd2361b479d9a7d729001500d6287cae5cae2b9e14b7e9064b29928059dad524738cd06f57c0da7d728533f3401ad90c8f00000008004500c30000000800ce00", @ANYRES32=r0, @ANYBLOB="cf00cd80322ec26b9bb38d0e9afaa2c0874ac3e848639d8df78a33ca7dd35172144ee5281205bb1130043cafff0e1d122a1a5e672fd234e096abb46a0625dd53bb070ffb39414cd67a6968e0367ca4cbc85b6c4713f82fde473e8355e2c88465839d997b6d4f5689ff2782e2ee8fd258e705f09c10b7220c5b69534865c96dc200ca25b5ad7d6fa6518d34d17f1549bcd8a1ae0263563e6f12946e6ed3b4977708b3e2f8204650407a3e123ef60b6d59d005e018792f2eba02af4870949644792e86eb86a084fd45bddfaa0400ac80006d0009807f49c1940f0ebcb08a641f4742ac039046077b6ef41c72428180dac9c89b72d7344972df9c7678de43ddae99d98f88e8ae71ecf77d95e0a69dc2c4c59b1e20838f7038c156210c6e1ae3ada35a5a7efaa092efe30ed7af940463625634718c201e40e3faad1b73c6e100000000000048017d8058002f000dc86ed399b3947aff7d892b8f0d378bc3f220d8107e672289365bc737aa6e8cf4ba175ea6f2577746f3618aa0953faf27d4e04c91269057d85d64ff6f2391fd143ad2d2adfe4a8f06f3a1c7f5b2511442d672dfeb00ac80650026000b58b56e9170e61e524e38998906731c4a998a3e63140d3e941ad3d31df8be625add4c2703f1609f1ef9a4f815026c40182ac0c1f2145e0f6f84fc890bea1b95af513b434c22010ea4dfda761c438aee71f0cd72faa24058b95fdd2ad1145ebea200000008000300", @ANYRES32=r0, @ANYRESHEX=r0], 0x580}, 0x1, 0x0, 0x0, 0x60008810}, 0x20000040)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r1 = io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r2 = socket(0x11, 0x80003, 0x300)
setsockopt$auto(r2, 0x107, 0x12, 0x0, 0x4)
pwrite64$auto(r2, &(0x7f0000000080)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x89\x06s\x1cJ\x99\x8a>c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2\x00\x00', 0x7, 0x3)
socket(0x2, 0x5, 0x0)
listen$auto(0x3, 0x83)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
r3 = clone$auto(0x21, 0x7, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x6)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = getpgid$auto(r3)
sched_getattr$auto(r4, &(0x7f0000000000)={0x5, 0x80000002, 0x2, 0xc19, 0x1, 0x0, 0xfffffffffffffff8, 0x4, 0xfff, 0x1}, 0xfff, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x1)
ioctl$auto(0x4000000000000c8, 0x800454cf, 0x3)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffff7, 0x8000)
socket(0x1e, 0x1, 0x0)
setsockopt$auto(0x3, 0x10f, 0x8a, 0x0, 0x14)
r5 = socket(0x11, 0x80003, 0x300)
setsockopt$auto(r5, 0x107, 0x12, 0x0, 0x4)
syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
mmap$auto(0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0x3ff, r1, 0x8001)
mmap$auto(0x0, 0x801004, 0x8000000000000001, 0x40eb2, 0x402, 0x80300000000000)
executing program 0:
mmap$auto(0x0, 0xe981, 0xdf, 0xeb1, 0x401, 0x8000) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) (async)
socket(0x10, 0x2, 0x0) (async)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@NFSD_A_SERVER_LEASETIME={0x8}, @NFSD_A_SERVER_THREADS={0x8, 0x1, 0x800}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0xc0) (async)
sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x10, 0x70bd2c, 0x25dfdbfd, {0xa, 0x0, 0xa00}}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x10004010) (async)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) (async)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) (async)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
pwrite64$auto(0xc8, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x89\x06s\x1cJ\x99\x00:\x00!\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0x10, 0x6)
r1 = openat$auto_debug_help_fops_orangefs_debugfs(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0)
read$auto_debug_help_fops_orangefs_debugfs(r1, &(0x7f0000000340)=""/231, 0xe7) (async)
r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000100), 0xa000, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', <r3=>0x0})
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="2f212dbd7000fcdbdf252100000008000300", @ANYRES32=r3, @ANYBLOB="08009e00", @ANYBLOB='F'], 0x24}}, 0x4000000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/loop10/queue/atomic_write_unit_min_bytes\x00', 0x60240, 0x0)
read$auto(r4, &(0x7f0000000240)='/\x00', 0x100000001) (async)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video6\x00', 0x80383, 0x0) (async)
close_range$auto(0x2, 0xa, 0x0) (async)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
msgrcv$auto(0x9, 0x0, 0xfffffffffffffffc, 0x7, 0x80008)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
madvise$auto(0x0, 0x200007, 0x8)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0x2)
r0 = epoll_create$auto(0x4)
r1 = socket(0x2, 0x1, 0x100)
getsockopt$auto(r0, 0x0, 0x9, 0x0, &(0x7f0000000140)=0x1e)
getsockopt$auto_SO_ERROR(r1, 0x6, 0x4, 0x0, 0x0)
r2 = getsockopt$auto(r1, 0x9, 0x1, 0x0, &(0x7f0000000040)=0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40000, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000080), r2)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
r5 = syz_genetlink_get_family_id$auto_nl80211(0x0, r3)
sendmsg$auto_NL80211_CMD_FLUSH_PMKSA(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000c87d93b646e912f0e76d8adc63a23adc3dcb1ab1b05a5eb76b8b5037b80cd494fab2e18c8b44d49d0637efdbcb43e54b01a8ef2a52a025d1ba023f3c2d78d282c27c4e8ead758901db877d26e1cb6e71100f616638628773", @ANYRES16=r5, @ANYBLOB="020028bd7000fcdbdf2536000000"], 0x14}, 0x1, 0x0, 0x0, 0x2004805}, 0x1)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
fcntl$auto(r6, 0xb, 0xa79e)
r7 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
write$auto(r7, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/102, 0x66)
syz_open_procfs$namespace(0x0, &(0x7f0000000080))
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x2102, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
socket(0x28, 0x1, 0x0)
executing program 0:
socket(0xa, 0x801, 0x84)
shutdown$auto(0x200000003, 0x2)
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x5, 0x8000)
bpf$auto(0x23, 0x0, 0xe000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="0100df251b000000"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0)
openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/kvm/mmu_pde_zapped\x00', 0x2100, 0x0)
fstatfs$auto(0x3, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x0, 0x8002, 0x2)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
sysfs$auto(0x2, 0x44, 0x0)
prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x0, 0x8002, 0x2)
executing program 0:
mmap$auto(0x0, 0x8, 0x2, 0x9b72, 0x5, 0x0) (async)
mmap$auto(0x0, 0x8, 0x2, 0x9b72, 0x5, 0x0)
io_uring_setup$auto(0x8, 0x0) (async)
io_uring_setup$auto(0x8, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
socket(0x2, 0x2, 0x1)
connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x0, @local}, 0x55)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xffeb}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0xb00)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, 0x0) (async)
ioctl$auto_IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, 0x0)
openat$auto_fake_panic_fops_(0xffffffffffffff9c, 0x0, 0x80000, 0x0) (async)
openat$auto_fake_panic_fops_(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
openat$auto_bdi_debug_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)
openat$auto_bdi_debug_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$auto_MACSEC_CMD_UPD_RXSA(r1, &(0x7f0000006200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)={0x14, r2, 0x23, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4048008}, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/virtual/block/nullb0/queue/io_timeout\x00', 0xc2581, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vbi26\x00', 0x0, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) (async)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
madvise$auto(0x0, 0x20499d, 0x9) (async)
madvise$auto(0x0, 0x20499d, 0x9)
mmap$auto(0x0, 0x20009, 0x4000001000df, 0xeb1, 0x401, 0x8000)
timer_create$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio1\x00', 0x20b42, 0x0) (async)
r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio1\x00', 0x20b42, 0x0)
write$auto(r3, 0x0, 0x100085) (async)
write$auto(r3, 0x0, 0x100085)
mmap$auto(0x0, 0x20009, 0xdf, 0x12, r3, 0x8000)
ioctl$auto(0x3, 0xc0485619, 0x38)
executing program 32:
mmap$auto(0x0, 0x8, 0x2, 0x9b72, 0x5, 0x0) (async)
mmap$auto(0x0, 0x8, 0x2, 0x9b72, 0x5, 0x0)
io_uring_setup$auto(0x8, 0x0) (async)
io_uring_setup$auto(0x8, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
socket(0x2, 0x2, 0x1)
connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x0, @local}, 0x55)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xffeb}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0xb00)
r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0)
ioctl$auto_IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, 0x0) (async)
ioctl$auto_IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, 0x0)
openat$auto_fake_panic_fops_(0xffffffffffffff9c, 0x0, 0x80000, 0x0) (async)
openat$auto_fake_panic_fops_(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
openat$auto_bdi_debug_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)
openat$auto_bdi_debug_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$auto_MACSEC_CMD_UPD_RXSA(r1, &(0x7f0000006200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)={0x14, r2, 0x23, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4048008}, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/virtual/block/nullb0/queue/io_timeout\x00', 0xc2581, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vbi26\x00', 0x0, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) (async)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
madvise$auto(0x0, 0x20499d, 0x9) (async)
madvise$auto(0x0, 0x20499d, 0x9)
mmap$auto(0x0, 0x20009, 0x4000001000df, 0xeb1, 0x401, 0x8000)
timer_create$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio1\x00', 0x20b42, 0x0) (async)
r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio1\x00', 0x20b42, 0x0)
write$auto(r3, 0x0, 0x100085) (async)
write$auto(r3, 0x0, 0x100085)
mmap$auto(0x0, 0x20009, 0xdf, 0x12, r3, 0x8000)
ioctl$auto(0x3, 0xc0485619, 0x38)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
msgrcv$auto(0x9, 0x0, 0xfffffffffffffffc, 0x7, 0x80008)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
madvise$auto(0x0, 0x200007, 0x8)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0x2)
r0 = epoll_create$auto(0x4)
r1 = socket(0x2, 0x1, 0x100)
getsockopt$auto(r0, 0x0, 0x9, 0x0, &(0x7f0000000140)=0x1e)
getsockopt$auto_SO_ERROR(r1, 0x6, 0x4, 0x0, 0x0)
r2 = getsockopt$auto(r1, 0x9, 0x1, 0x0, &(0x7f0000000040)=0x2)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40000, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000080), r2)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/status\x00', 0xa140, 0x0)
r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), r3)
sendmsg$auto_NL80211_CMD_FLUSH_PMKSA(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000c87d93b646e912f0", @ANYRES16=r5, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x2004805}, 0x1)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
fcntl$auto(r6, 0xb, 0xa79e)
r7 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
write$auto(r7, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81)
read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)=""/102, 0x66)
syz_open_procfs$namespace(0x0, &(0x7f0000000080))
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x6, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_tracing_stats_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/per_cpu/cpu0/stats\x00', 0x2102, 0x0)
readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1)
socket(0x28, 0x1, 0x0)
executing program 2:
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x82400, 0x0)
setsockopt$auto_SO_SNDTIMEO_OLD(r0, 0xb7, 0x15, &(0x7f0000000040)=':\\#\x00', 0x2cc)
pwritev2$auto(r0, &(0x7f0000001080)={&(0x7f0000000080)="03a68ba64b37e1f60ff304836f2785c9bfd511ac72e48cfd810343989a28e115be3dc08ab23f9b20aea2389558639d3a6efe752e594947dadb5ac62c16eda0ea90ded797cbdd129bb0650edc653df4a0dbc48d45a9184accf4ad5d34a58450835c1b8582c13282e1e1292890674d856499de6a3d7f6d25c51daef6b811d96b4299a7afab1ccfb2767d9df9ae3234ac415243c9c540c5efc4d52ed953cfa42e06192dcbbc1d509acbbb884829add591f374e772b77ae76ac865a77f08844500b2f600db6d358268a3c8c6e26e4990c39d0581cae95570976290238f5c3d0e4969d0d2b0284c39fa02e4c60bd2185650b7fb8432fcd78abd297cd5e508a961cee806f173eba637377652fdd889da47a0a43ff016da90e8c2344870e6ce4884a64ec78f3eefcdbf93c10910e0276f9b1dc3f24ae6fa72cb28426b7b9afeebd540bf8273f51b5bb2fb06e80efae3abb5ad5a7d4700ab01ed1e399f02272071ad01f44365f97646f7560a08444783be3967eaf79dfd1199ebad169690d67d454699d873c02cbbd5fc68959096cba4aaa2dc89f1bab3b53ff50a9f423c9bf552797523b93c139c9b2b8465cc9352b81bfabbaf6c42189b4251065e7504ff1be57e5cc2f7372e27598b94de2f1654f15b54124b1806dfd13aca1d0425542951f859d99f0479b5ba45e5534b7b6af295fae7f86694f315c864d0bb450f1c2edef7119e9d3d9c13374082fd4298f12bf4111fc009132435bbc6d3a4205b455ae7f50df3fa6f8d68fe4332b1296ece00bc3a6830f1d5d1f9f389ef87db65674d9702da4bf7a049d6688fa6eaa178773cd701f7242f517b5a0c7356d7c5d93efc11524a41b00109ee4be2e2e42e2ca3869748f676c0ca55126b5bd3f4d80e4cdce1ac9f4e2528b727b051340c5bb8ce262ee1e38007d6e9ef86041cd643ef57c2e2924b8d6c67c8517e935290ba0451180132461951e84681bdb4e6f7781329c7f83d6c7e18cbf1c5d9cec533e8879d9467686ae2f6a16275ae957f50b18c26ce65cbc697acf3c7b2fba1ec419ba11e035b86a49a2be2ce3ef67f35aa287955bec23929ed12945faf3318ff9b76ce5846dbb389041384b0548e1eaa4b63ea18f9af3a11d1b709ee916a3d2e766de73db4a377b8abf97c3a77bd6fda94424cfd2a3ecb83d100c486fa452d83f26ca2703966ed5391467cd346adf34dd067765d7fe538cfdf2a20c5670144aacd2ac2b1c8d658f3ef81a117e37e34a5162d9e1272ce1bef453d500945e02aee94fde8ee734b7cca6241700eb29a7b797777d753cd110421a2027bcb054a380022bf51ea3a6e973fa50ab46873536cb18b30bc2b728aae343b5db6e1bcc8b40bf000bd5aad8531a45675b5c9035ec57bdbc9785d1bdaad024256b6cd1d4baafe14e14758cb7908a7508966a67cf2f1ab8b83d83d1455d5fcc85367f66ada21049b76bccc0ed9bcf5d85954acfbf2851f5d117ace732b59104bfc4ab2d8ae19b3887a793e0954044d5ce9bee9c0cb355b329cc1108facfd5057b07232f4bca3c22510ac3f932525c4ea66f4d94e5e16e8c90189d04f31778cf0cee3900a8630f0906958a1529104f9d9f24f56802dd4e9ca28701d98bde44cee5e0e091626b1e6ce85fb9ecfac374be11a0f4afccecfb2caf96536857626c8c1038b46774140661af0ee132ace082951f47ed6d878a110c5fcfe4efb8db9d9f0a613a2b4563551e0b8d343c3bb8025f506b2c84d179ba9e3fe4c9a3b5a2580ca7e2cdd795493d2d794989e8cfdbe2e0a1840a5542267814204390a3a5dc59514b852b8240f44826690d5f13e469cee4db099e9b31ec0197daea084c44c463a0ea44a1986c9b7b807e5ae0f36dc963c06ec5ec0606d2d6a6415a148a4d51b9bf94fb170e462b876f7d4bbc46c1551977c3a7eb12874f24deb9f666b01cd4e12d67fc5a30d675eb25f9759cfac02bb7c9f747f371e29317c537a8151518da2d6b0e3e1e0c0be5c4a56b16524c1107590456b9985c7850045291b8226dc9b30094ca5a0098f2a51c21e6c6a9f9c73cab70f3ed6d1f46a8f11cd914e6ef9629ee85372bae5d71c236e3a88aec6245381a85a92bef721e9fc4c7e7ecb4611deaac663450ff7a878062fa7cbedc0e6b82487c13b8dde77f5cd0b4aafe865b0911f613085e445f08c228a4194ee7478d19d6ba0c920c60b91c1d0b223bc477bed7bd74c039156b1672ab1193a084d0af6f09cb0c36d4e784b4493828042c9eae3dfd993bcba7c0b0b6c424cac6e6cc2ac7d6b2560f62d63d60d44facf12cf1a411119eae430e88b4a788dc4a86b7445bec2276b2b2bc0969286bbc3d965cdfa06120678ea2757e538dcbaf7cdb98ba655daffc06fcca2acf61a8fe618c2f5d1be61cd40b89d8d426a482656d55a164c025f1b6f407eef68a6121ac3a73db9d01400ba86f2cee157255b1f7a2533a1fffe5b78dba3c83a12ab06ee96aba54783099f6f07699cd41dd2cfcbd2791d9af2492a8be0728f0cc5782ad0280c0172370c80e68b4c810420b85be8fb38c21234b9ba7055ae5bbcbe929de8873fe2ea0231ab8d12b46bd51d41e2a18886667f02fc1270ddfeccdf6e4c110db066d444a82f76bb1bdca1e7a20b1e1c281a1fcfc6a812e9f2d3620e9f738dae4685b6a8c98742922377181a3da85874d4cfc05016b6305fc984cee4074c63f53c642c30c18bf9d1ccb644b18a4d4a8ea071e99baa914318f3d7ab88c513a241cf98165d60c1f1d44f71e0b104646d1163a1dd2f0a2255de07be69c60135b834c5bc415ce39b14359a34e48c57c65871b11d76eabc8b90a02f052aed0b88a1ae9afc77842ea2d50c5cbc8389f96ff65ca0fccf6757f999e5daa0ef635a1e18f8e655a0fa3523527730817c1f36173a493d93ab9ee601c39024611e766eb0ca297a4aa7bc75d3a10ee30f9333d9e100d8713506063e83da0620d0ab8dbe198e602053cc775dacc275b5edf67557747bb8d99d27bafcccb738f6a9bb18dd701668cb1080cf60e509426fd619529bc1fece4235f92e7a66f2e35b443d23acff780a9790173c3e918d7d625bda7f4c31fe7d2f44b23726b128a9943904bcfdcee0cd0ee33bd37f8a6ad7d5ad54b6933155eeed3d04d80ade2d1634459f438712a867e07671f7701c3b40c338a6f5117ac27cdc3131861aa6c38060c6f57a1ede811b4b17eb71f0cf92098a575c0f25e742987c53871dd908a1957b295f2f7f13fedd7463f1a025b9c6d99d782e32cea2446fce416becfc953fc1b7af71e4c54831fef07b4c7cb2e6bc4982f343759bc9cf444fadeba7bad04b7db1ac4aa6dedfd09783177d8a10ddf3e16fbca4c9608ee460da3eeebfc18838a3e845f9bcee8245a4c4db105ec67db3428478addbd1385912a18e22b4891b565ff1ca92d7e438aa860e2420fc6025f40597c7195a658ea10190fd0f193850016b7b2f3a48cc5d3faee303885a679c6d43853621a7c81ceb09e82db2027b91735cab37bcf32a20e09c74a3e6cd5f4d70518d4c60dcebdf867c37a1c687ada17b04c4911cae417470ffe10961f21113778f37a5787fc8696c228d34b3960233e885e035df2122c829123092b1e8dfcadcf0075cda6494ed25627e5192fcc37b97ce98073e306786d60a2c0f9d4e8811cbd9f69c3bc9ab1ebae31c676509084286ec4face04efe3d786a40c63219498fdda83a35354415d43c7094527ed583a9c3cd815f1fffe87987cbb57b3824e213ff6825646430d329cb83376f79f660890dd8a4a3ee1c8b9b61d35c484a97882b293a6f85fd6cb9e5101bbc152b5e7f3a2c14d54355d874f3efc1545c756dc6fbc6b75872a491bd4815184c0bbd85271ed464ec414ffe18de84b61968fd13e885d4e232c48a57b428ef22d26ed261335230cc95cb700cdc64ea1e0d4fde05183b1ede5f9f1168e040f29f43934088a43abd0cc83b62764ea9367a05c90832206d0bbd3334ec725378b71650346abbc60ce11136a69f62763c5406d8ef480318febb5b063ffc4faa2a03b33b5d96b8f44b922ba0ec1759a72d3905fb08d856d89b4b1143abbc053641d5f5bdc8e40b22eb2558d19964b55814b1b0d386f3a38e4a836045b091eea22ce8550d206735b921d5b71897492a790528bbff84ec2bdd1cd390cbe7188ae65be0b08047f00468d4a8dbe6b92cdc4b897d9432399f3b3c721c9cd07a0db5665854ca00431b36f5ff9faffc522e921303edd9f35d698402da6059dc9a1c203671f025443c1d872e3ee4c5adc59b6f905eaffe47f26a33872757c893af25d59b7d657b1c1c68175619a69a0d99e7dec51feed6a3cceda725127d4342e9e32a9239b21ea8b8cb84c494cab6f5f028169333152bba3702ca08375d6e5d96838b42fdb98ca89f77f6a4940380ec23ed3ec41a29e4bc9d50a8cc6bdac9d1186bdfc2134fc73aae9fdb8ac0202c4622cddfcd5f5306876eb0c3d6ffdc2cb5acfdf9a27d7630026682b71e26181b6884e0f87479361465aa6ef04784fbcb545460f54833e84423658ef46e6408223cab3617c75fc52077b2613994457ce2101bfe42b087fa11e7b10e23e5ff409efbf079f52fed2409453868fe49f468c414618202bbde8625496d54c90d10b204fccab7a8bb98444c6e8fd3a5b25879534baa325555a17a6b147350ea6db33b2d0ce88799c98b3fb9d7918a2f121cd1ff0db22ba526db383be1615114c5fa766a8491e8fb0916f0cb86a6cbb3099976fc7a8047dc3f8356e7998d98351d3903f239cea260ef2c1cc6db86a48f31c372631ffe8ccd7eb7ba6c77fd25f5e28977a305348eba89f98e549042e1c049957e5461339521578476a43bf22a76d0b81012d3540e7435f7844e204b699bb6da811f5a65d48a23782c7272fc63633bd9b09bb76bad07228238e34dfcbb668fba754ccef8b16c589d5483e85cbe8325b99e4e7c75d056566238ce97da559c6e6960864e8dde1b2117433129ad6e21201fac805b5e8bfb07e39a86a9359931e6e1a07eec15549d049b49c5945f943c795a335f0d77877edfd235ada4b4af8c5c894f0ca8199eedf21d553ffdf3c87f2eb2cccd523c453ea813b52b984be554ee26545205a1b11e6cf93c3507a42dfaf2ed5f23c216f0d83bee829eda04c01f5d750297a25fa43edd54a738e3449dfaa9d85d7ffd07dc52ec6d8d5d3965a44b0760ccb98ce85f20f43b17370d5bc7a554134b7444894a29546cb031db3dbd33ae2d266ea857df5172ef842ced97410e2fb95a6e4348a399a54c5ce90fc3a42fce15a282b4234b701b72497391ecd84627b0e7bc6f9cd77fccaba3dcf1991f958201e653fa796e73d4cc933b341a9273c38785c80a2e855394582ca9dc989db5a61bea00d4bc53d42ff028bdeb372a0795ef03dd2a222c1cfccabcc178f5982882f63d437a0bb93805dae41c5eb2d8958c9c274bfc210fcdda17269b7865f212749676e02ed53e011d2f38fe99ec14f364a12b511dbc496db7b146abc4db4adf536b40aacef46b457ab65996112aee2ed298a20f7f29f96dc91d0e7fc96d74b0177ad86b3228ac032d25a96ebf8a796a457dca504b74e46837e4079eddd80fd03fca10c6f48c668aacab544abe7372da6db220603c4bb8cf7d8eb65fb2912773d1a11d7a6ccf1522505fb9d4e635b886b845b8a7b742ded469aac7dab673ac21dba50548ef05bd2f03424fdecf1c10ef4d9313baa809eea46a581bb4879eb5484e44a7e02ddfb9a8cbc1ca9fa53ffbd88f57b7a26b82c3765668d376b9a69eb9c10b3cd2d5db", 0x2}, 0xe74, 0x0, 0x445f, 0x35929f69)
r1 = dup$auto(r0)
ioctl$auto_FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000010c0)={0x6, 0x3, 0xe, 0x7, "5a4e090176db0a59"})
r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001140), r1)
fstat$auto(r1, &(0x7f0000001180)={0x7, 0x2, 0x0, 0x9, <r3=>0xee01, 0xffffffffffffffff, 0x0, 0x800, 0xfffffffffffffff8, 0x2, 0x8ff8, 0x0, 0x4, 0x4, 0x9, 0x1, 0x1})
sendmsg$auto_NL80211_CMD_SET_SAR_SPECS(r1, &(0x7f00000024c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002480)={&(0x7f0000001240)={0x1218, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_BSS_SELECT={0x11c8, 0xe3, 0x0, 0x1, [@nested={0xe7, 0x27, 0x0, 0x1, [@nested={0x4, 0x81}, @generic="dce465a2782f492e4e7f92cf4f6f49c2bfe089952325c69aa4508cd04c2f211a8148210290ddbdf2398b80bfe685ff45901663d21081e1d4357d18003427194ad23a2e129cb4732b1c8c4fbe1d7401bc11885a6093ee85084bc9ace402a8b2ea28d1785ef528aad962496fcaee31d96bc5b7f2dfe9a0db656291edc56aa8c7ab6ead5a5b305c2d3f3e3dcdfbbec8753f3327be37dc2e7add968a2712ce83b52da45d2ed28911c725e9e69c2d2e1b21eb8e928f00350d75a01a5e3ab3ebd8e24a3a948e5618c5c3efd0a3829bba78ca4559da8d", @nested={0x4, 0x70}, @typed={0x8, 0x78, 0x0, 0x0, @uid=r3}]}, @typed={0x5, 0x134, 0x0, 0x0, @str='\x00'}, @nested={0x10d1, 0x7d, 0x0, 0x1, [@generic="703dd43d07c957d8ee4a4e379a723c7d861f221eba3ef3c9beaefd900e1bd02810a6d990aea38b5c89b07a91d80fb3c86b6ff1b7b02bdd5e9d803bfc5b4e2d1b8ed2831d4821cb2990f7e2017c4bd275577563e20d5d06fa9354b16d64e5bf2b85e6be8d6e5209e56809832f47b918fbbf27aab825c81947a7666be026496164bcff328390bcea28b7ce78c475006a54300a56457daa68d0104c0203bcf878d58250ab0331d12b5d3d3932151c4cca6d492ad4525fe789734d78842a38035125ad374d69123b93438fbcd0111b118765860d3ca7e703a5d972103d1922f5bb6287924f41cbab826332787a05225c1b87600d82c7474ec5e10ed12662ca80460cf6b918c9f33bdb3c0a061f4cb1305eb62cba00941e915f7afdb4e4f387264388ada73aa467dc4183a67ca0361b8fdbb7ad0fec6aa711769bdd6b84b00ff10fe7ef85b9c4f1de3d791211ab5889ab0d4a8f8f8e95a5a2825f1815002dca282fd41e0a608cb485bcfc233e2e13b6d4afad5d5f5183446031f285436fe6c1347e83a486d2186580244aa4d5a6aa1ef345202d313e65ab4ff3c65631ac0e4e9d1338d8e538faa3ac7cf2e2d771ece95926a6f1a33c3a96c0d1616bb2d94d7456ffb5452b750ee6ed3ea239106854cdba9e0b9e777ca644a0b4b93f5b7e813471546f46f3b0a8dfd3f5a88b2ce5ae7ec656f43b4b094f27443006b31363a8d4bba025444bfb0f02b19ac78a2eb112f0b5a6b30b3e76e0111e1b340fd06178895e95c7a8aa83ed4d6ce413aca344ec0b88ca8ead47fb7ed2b42b69bdf3f91ee912551869825aa6de26ab2db3fd2a31f55e49db2ddc9390fdb6bafb6a11444ae7f0677d8864cd965ffd7a70aa664c9aa007a6b5f441291acaa84f7aaa20ce3d2e87fcbf5437f00027d0bdbba200d547f574fceaf3963e834443dec2cae0d102f84b0fd3f2b04f8787777983be3933285920136bae3cc84558a9a710469344d6d1a985ab8caf30aa8c9fa5396aefe221068c52bedcf0e39bd7ff35e509a5f18e9e2f1f5b0bd0fb0d622fc96b87b820f3829fc6857a9c392d5348a406f48d2fa2a7f69cd945e64e3a2052a16e40e62880f49e28e950199e5af68c25e73f0e58e91641db54eb59a8891ba561aaf0e0e27d8910c41cd5e5526bf0f2465623e9bc67e1c6ea5120fc88c72954175de237f91c7a0599b526eb49a1f5a307baffda60f4b23b6a3f9545a686ccd8f2c4018a5ef57a45a6933789f8ec27bf7878258f59d4c1e48f535d2ee590f60c2cf6f64b56eacc093faacf40a197119e6c9b2627b0e539055cec6fac5a306282bdf1d376385aad06969e638146f42909d79198be67fd5089f531750ec87ccb14a6ca4e74a7fbaa8156e20bde33750bbe922b7ddad5a3558510f745af09491bfb49d9bbaf4f0f82e34f4d8c4935a75d56f6209d33c76f9196d79e6ab297dcdacf3a87de657918fbce9d8e7c8121e4fbf1b30d2019339cd7f4546e15c5288547342f5ef8a86326a4b54d79cc67ffec2acf5ea1066e6117efde800a10858e313ee69ad18209983b2e38bb269d294baf0b5a5bca7045e0cdd71b2bde0121fb4c538f6a91e8b1ec50a958ef767d0c25b7a4e70c02956302e754100d4f3ebb7646590cd2241b6a7b655c8c723d9a59acb7442275e9e9f06940fc2122a82c29e77fbdbdcb1f995059a54383e189c8023d58e61c7d280217c01f4b15831e033117a5f2a47a81f8e5580804f73fe9729e2893241a8f50ea1db1d683a741ab1afbde5b45c879342b5321cb175270038e83324d8cfabd14b98cb2475a91b742fedbd1bd1ed7d9b459d05c218fa40186db33f8ef8681e0811a233c4bc2807a293ead2bad84a12b1efc023a3a292ab3305ff96000857d1a3803ea360155c4105849c775621cf33be6592662e3b6b564faa749b3e17ae2ec8f5fb2ab4031ca11000deb646b02adc89bb099c5d46c00057bf89f7bf1d87877aaa0409b029284addacf2695405d0692fde277e18cf8182ce234912666389f62f50ed8d15d2c47dd93392320d60c5c805720e20ce44696d7489376cbdc23c477cbf9fa440be1aec276ce6f890930d8e07fb2600d3b65f1a9bba8fc1d3e646a1d9f1051ba1aec944a9d18582f1f9f5110869c41087ee0c25110ebbb92eff9b1649f5cdc395bd1733edfb0e8b394cf49eb918bf2e75f4ef1301ac344d0fbc7f5687272c0ceadaa85d57694a3b0c4042c4c2ff5c21ee6cd186385087222366b16cca9f8d2a690c03921f9e068427cfbce56d5e852f9b9e4a4119ca27f6fd3b81213d8192195f37a8e54cead3e258db1b469caf5d8cba60ecf598d812ed05f5db6bae9b5e4369dc9c06e1a412025c32608d76f5203663fb7dffe7942cf13c010bba7986b448ed06b78233c67c3c3654dd370e5ffa713ff95e76d7abd84d32c316827f19c01afe3ff7174d86a8ec21e6b8d565f7ce54aee64d0254082f4262ef13ddb76e2b548614b7241e8771e42774a368f38098cb717a65fd1e4f6c4107442143afa760681049f026a7e3ad33b4facc5d0fdefb5817cdeb2fd07e2ed4099b14c71eea94c113275d210344bdae9c29f41776057cbc8d3a4ea6f4815bd37d4df937d364ca799a28e0ec47d80e6ce68ffe54bf8fc1a9ebde2303daf7d13b6cf76b9e310629a9a544b9ce61078733d8daa92c66da9764225977b142f02a52eab0f913584ed31248d2788f9983baddb540089d4b7ecf01e60c77cf1ce13a120aa404140db598905bc04c7374741b7322fb34ba200bfcd284485cf72ca861aa43d483a62cf97aae745caa6e77a6621f0d5d9fa03d88a62d61ce404ec6d78e6809b97e338f7a017e8dc7311abf56618358434833abdedc3414179785476799d857b16ad2c9d11dae9e35e84f20b07179b1cd0c26c5bdc83eac89b774bfef406af5e142491caf734c1622ba128cc766cf7717292cb244eb68776241f8db83069184d2dbce087b212e5b468ee8787a144ddd626f019197754257964df1faf3912d6c81a6384a8d435756f31210fed9831a88618614b6e024afae9457bb6a954486e04831204392d7723edab6df2a8d3b26a33d75bc02b470c18f1a68a0d010a5ee4476bcd32cd8a9380df9ae876d136561e1c799717292e5343ea601664d9c7b08bea41c724bc2155c0a2d3d99e2009aba855f2b20458a86251f514233469a837814e8b93e4b9bcc1ff9fdc531f2d8d9eaaa7a36e528afb07579fbb718aedc47ad84540db1ca6017c93adb99db4bc393d03d24e87922b4524d97ecacbfeaf90db43cd84f8b3095c8c66ea390f50b58db7251bec6b830eaf4222253350e2abc09d9be9af4e08aed99718d3e8660705d673e06384bcf5ea1469298c133ad27e4cb1b81feb60ea901ff959c57bcf5e5a837462838deb60745d56b254222e29f2dbd9cb59d38a4ff5bb137d70bb55af02843e0b0e45fa735c04f54ac7d71ab607660a8749c754920dd3e0afa7006a078de8d9c7e42cb6c62fe82850620fd798f3e4ed2594d65ca779c4c9a78e864726dd4d043d357d0834cd32647b581de709a0c63857b8e62736f289cdef787e0dbb6f17848c82d7604ad1a9db21c61ccd2132cfae48ebe8e44aac1400c35c67f3b8cba5f7a98c90e2dcdb7329c0197c2c673bd7dd7a4b0cb0572ad62c69a325b24665d180b01cc788d03e6b32a84bef257dc99b0e52bcfe24632425981f9537df4649c3f522cf6dea0cf5721bd8924b3ddc81a35ceef710b05a06c4fd4d87100645da96e7cd89e157bbc6130ac1f43cc7ce526032d377a71fb558a81fb9def54afaa05ed34b3eeb9fae9eab428aa18f480ee06b9c8b39cb2682266ee9aab3b55fa1574b43e1ad39e16e0a61f85914871f1a41a0bfa1e147b05e9a645d9882841ec531248c733ef621cba9c3beb2ed0a3df17b25bc08c04882416144555126c50f90dc52306b2f14a7537effa2bf95028b0fc6cefbcbf74f0a2dd46429babbaf929f5889edcac182ff0d780057eb2472cccd807c30e2eb53b49efe3034cb93f31b4d71e680336cfd1109008c27227dc7591cee9c52cf3cb0ac418dff6bd2859e0e530a6746b5f62b51af5e2b7d37da07c1cc0bc39c3a62ab89900d7106c8922ffff915bfa62f3c7fa3dc9f2b9e7c17530fb5d5b6d9b45281956018537af5fa048d7c5c0a864ebfe32b2d659acb44ec2fd7f6bb3df9bcfb8cf34d8836c4157208974ee4534c0010f6c010968f9776beed88deed080462cc0d24718e03babed5e3e5799db503432fcca824bcf017b2bab1ad10a00befe547c9461686bd402f6d43ba3f75b931ca4ebbbbde45578f1c29407b16f6e7da7a3284a6b4265fae49bf000a19f89f95dff8ae153915fdb58cca9348868345ae82a01e2a79d141a8e5716b99a91a85b9665ff38882d062ab8ce97bfcbb13a93e381994340492ce7ca0a08b83c9347328d4a79cfa7dea692032ef53bf4122b8af319eda76fec45fefd99fcec08d72026c28cb4488640437321f44bf973bd0f339f13cedd6cdb2cc9442a1ca9975875666f67cda51d3cc4bfcc5e4208156186a5d424ce4465053fdb9617bcb7520b9b05fc929e598e9c0a30f5660b0e418f141414310c150c7d593dc1f86c4326374d5d68d4424c9eb8499c5affa9cb238dacf887aeb4e8101cddba9f5a705ac4d6f73562dd0e677e4c2c947e2beb6519aab12456b95743de14d2f0242d289e2d36239c887b413f2b0151fb8c2d0de1a4bbab7407627a90db09e73953710e8587aaa10b9ed78c1e9d43d90f495f0ae5d14cfd78d7aaee135eac626b4d252f80bd90e43156d4dc1e8b203358d12a32c9b4997303f2024b1cacfe11424dce281f218ca108371b39ee8eefe1b4a144c6b9b4009a3e4577c80e387953803c6135f0c08225026a6ee4df6d75adaee120afae68811d925a2a6281cdfd2381d8164f3738bbd5e20536e9e94a47cd03594683d9880e456ebc275b376a65ac66ba18560a9fad797707dc3b49deff2740ff473967907194d89280fd985e23eff8ec0b388190f42601e485d167be79b982096247ffb678b683051b9c434ff1b86debaea560436eef71255615684d371e4a6c02f5b67d0dc669c9595d88581b4d0dd8ea6b658b701bdfb6f43d0cecaa1b6264fe8bef9f88599f600b6bed870917ec061d9aaeed2cd01a1db3569bf7b425643dd13ce0f01c0e8be47f2f4750e12b17f4d12ad4593e92d1037ce39eae0cd96a1ee6f2a07765e7992238fdd17ba30a601bc80e515b6c5c309434b0402b4e941c5ec42101b1fb26089403b235289a5d67a8e9d8dc41bfc3aaecc3fa1a50748f36a0cd4233496446d8fbf2ee59c58046baad46228cb0b82507eb607fd177bdd8de6b0611c9b7aee1188ac6b998150bc87b6b1bf0c0b015d8044060361ac512d3ac573e034de31799fa36b2da367cfe455f99c6299a0b517eb325a3752adf4a32adc3f6bcf6ff5772f3b2316b11d5a674e042d8462bedba5b2f4e0b95fc30a1a7a7fd82b58ee33878a38e6bec5d19ba64babce54950b696cdcc7c7e62ea39a39d9607f182a4599e5126c364f734b0caa44991666f5a1713b8970725be5a58b2dca73502c2cf9004b29a337e1dbe9895362ceb1d7c7a5b28617660be579b1544b253cf16bddf9e48d533eb72581efc9da9e1317e54de92a63c7ced60124d555be33e81dbb39d65c4b3b5ad27d0971871b6ccf4d8ec63cffa6c7de435d16d39b734f7ff640fe68d5ae67a8fa37eb84adb3e154fa106e25bdcb14b877fa6171db2aaa99c0aca5951dda8323ea2e1f407f894bbc296654c09c90", @generic="09c148e39f1ae962dafa1a840b03ada70dae", @generic="0ecb61a015ca478de8adfed7b3a110ce774277c3fe69d8292fdb03b93e410109a93a336044683194a5d296fc3aac6c34c6e1d04d50fc97d19d2e818b1b2dbe2118944bd51c613391f767cd8dd446bcf15104c971cdc57dd7d71e064ae066595c0b591a0684e3fbbd4699e708afa68b3f79b2b670d0c02a4c7c181cc9bdea43d20b86159c59afc7e52f2e7421e5fc31201e7b26e5f44faa13210fc0ca7632e8063e80fbcb00ccc0895b73280c68e93e1ebd5a3f78963d9a7839ea6e"]}]}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x9}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_IE_PROBE_RESP={0x2e, 0x7f, "2b8ed71e5555f49a4cea17b1a439374e70c19157894f628bd4278872f457904c9aea0409205921f7a619"}]}, 0x1218}, 0x1, 0x0, 0x0, 0x10}, 0x4000000)
r4 = openat$auto_nsim_psample_enable_fops_psample(0xffffffffffffff9c, &(0x7f0000002500)='/sys/kernel/debug/netdevsim/netdevsim4/psample/enable\x00', 0x0, 0x0)
r5 = bpf$auto_BPF_ENABLE_STATS(0x20, &(0x7f0000002540)=@batch={0x4, 0x5, 0x1000, 0x10000, 0x4a55, <r6=>r4, 0xa, 0x9}, 0x2)
r7 = clone$auto(0x9, 0xda2, &(0x7f0000002600)=0x5, &(0x7f0000002640)=0xfffffff7, 0xe)
r8 = prctl$auto(0x4, 0x401, r7, 0x7, 0x81)
r9 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000002680)='/dev/dsp\x00', 0x20902, 0x0)
ioctl$auto_SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000026c0)="ac27c50018ea2d925404f6f13da0ec6e32061d48c3b1de44d0e8d3c91b297e6676ddd53a4381d76fd075ee037a0c0290b3e3f456f19fec2c561870a2a94a9ac2f47025cc0ccdb15ccd6bfd5b43f54142e657899991cce864b737cb428d9cce40304bf37bb4047d84f1a02ad2ddb8ea9cce9ba4f95bcd118d90790a342e083146d4a719ecda4a7c5764fea4e51ab9")
ioctl$auto_BTRFS_IOC_SET_FEATURES(r5, 0x40309439, &(0x7f0000002780)=[{0xf34b, 0x8, 0x5}, {0x7ff, 0x400, 0x6}])
r10 = socket(0xb, 0x6, 0x7)
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f00000027c0)="7f12b8bb955748130cca3495ce19782c793cb17e5fbba114848d411ff2532e29e3f87982a5b0e2043e61528ade4b0cc95e6c0c9494310bc0be5e83149a03aa8131b753a3df03")
setsockopt$auto_SO_ZEROCOPY(0xffffffffffffffff, 0xfb, 0x3c, &(0x7f0000002840)='[\x00', 0xa540)
ioctl$auto_RTC_ALM_READ(r8, 0x80247008, &(0x7f0000002880)={0x9, 0x6, 0x7, 0x2, 0x9, 0xffffae6b, 0xa225, 0x9, 0x3})
ioctl$auto_TIOCGSID2(r6, 0x5429, &(0x7f00000028c0)="21e6d34168944568ab436499dee338252d580f1189441d5a2de527d6e541c1dbcf96f39af81ae24422489ad1e6512a3ca3d66c9ee1de34a49de4b55728644c357e53824e4ff110865c623fcfe933d8a6154cc2462b77823ebdf7842058c68d9bea08ae75")
ioctl$auto_SOUND_MIXER_READ_RECMASK(r5, 0x80044dfd, &(0x7f0000002940)="b099a4cd7a7751a8bf9e9d82dc33d97602aed5594d340a192aefec358d9e3a4f900889e97645b48bdcc0744ff6581bff5aef5b3df54ea983c8457be6f633cfb14fd4e4c2227771d72f33fda81895ddcc6b46fd0ebdd2eda7195267d0ac0b237578bd52f655cf83fa94de5f2792dc666f8288d7c558d4f10e873f58f624f9036a1eacf2c043a2ecdb80e7722fb9a5c4e73a649b511b")
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000002a40)={'syz_tun\x00', <r11=>0x0})
sendmsg$auto_NL80211_CMD_CONNECT(r10, &(0x7f0000002d80)={&(0x7f0000002a00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000002d40)={&(0x7f0000002a80)={0x2a0, r2, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_UNSOL_BCAST_PROBE_RESP={0x1fc, 0x127, 0x0, 0x1, [@NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL={0x1f5, 0x2, "c1086d7d822e006af542e7a26e80648684c823f70bfc61a6de9733e8d7bec0cf44bac99b9f5d4539bbce3a1948d44595b43eb23aaaf76d74c7bcc7ad3548f428c9d78dc57e2f6d3c871c9bf1bf597f028147b78943de2ce73fd98b4096fc2ab7ad4a9359e3af35869d40b46e19bacf0910d794b2376f49bf823e52e2bea76033e44e110b76f847afb890ca8261268c110e60711b28024c1f247785645e312e1818b80aa9c812b5b45397959889e158492f094e854f1f5a989eec1c15116f924baa976dee398fdfb553386c36599253512eed5de2973aba2ecab1d4476af128f53816232b169e67dcb9ce299c9f1c0e69721b0b7475f0c9b6b02510b926dd876c13335050432f7264d738a3eec615be70e141af67a6fe45b18cfb6ac406906637c8ed5d695fb740c540bd7a6c0d0416d0e1ceffe6f6cd426d0fa010fbf4186a3830ac59957fcc3f0845ad0ef1ead81f61c7aab5c2691c132294af81e7273ead0251d038c8109f406cb6290c63e7ab48edfdd8c11598a0a6baa6f506420a03c37d7f0cfc180f940559811da75a0c07bcd8c895e8b5d9f16f9857782f68053d5a6687110f4775753756394f67719aebcf6968a8c093933f586a3f2f5809e7803974488af8aac2446d031c673298fc08a362fdfa6c51b15b06518d826b6ade7228311d99345bf1550da8d5e3043c1716fd4b6b"}]}, @NL80211_ATTR_PMKR0_NAME={0x51, 0x102, "ad89c332f875d8f4a3e33acec5bbc4386569af4ad78bd632df431087d25e40581f161d7fba82571ba64ab9c11a4a8f061a034314fce7ccfec6167ad42f3486a6075b017726b021d9afcc9ee2c6"}, @NL80211_ATTR_FILS_KEK={0x32, 0xf2, "84cf6cfbef67f378f30627083389ee0433e069342837f0698609647b51f0688cc532ca74c843c572451f03ea11e4"}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x4044}, 0x94)
r12 = io_uring_setup$auto(0x7, &(0x7f0000002dc0)={0x3, 0x2e, 0x9, 0x30db, 0x7, 0x85a, r1, [0xfffffffd, 0x9, 0x1], {0x2, 0x1, 0xdbeb, 0xfffff801, 0x118c, 0x5, 0x8, 0x0, 0x8}, {0x1, 0x3, 0x2, 0x4, 0xaf0e, 0x2, 0x5, 0xb14, 0x3}})
recvmmsg$auto(r10, &(0x7f00000030c0)={{&(0x7f0000002e40)="360956e4fa87ca9803bd4c339765ddca3ecaf6f99ead741521199cce35361b1305cf405880cfc38d1f28dd28fa053785dc7e571fe938785c5ba6ae6a2eb54be90398dd04688088c92316c8c6724f854e7a243ab5b5c161f7306418c383f868c2a536db922d6f8791ade508abf1660e12a13c2877a9b6b1", 0x4, &(0x7f0000002f80)={&(0x7f0000002ec0)="6cecb136a9758734095647f64cc41f65860de9c956f8fc35041d9ac4ded4b990623811c00a0aecd10a48a1d62bd19695ae8187cde14f3cae97bec509eddce1415ff0da74cdb7a590c4b277d13b38709882ccda794b7f7ca4937b8f95d174da41caa702176debd1a1ef83a410f093921cc6c700a0649bf2b774e5d2654c4722cc8736b1", 0x9}, 0x7, &(0x7f0000002fc0)="83235db09b73062ed112a1cae2005cba69c41d235ee014795930cc31c76455905080ab1920d3846c7db68f8ce53e58fc2a3abd2ce4d9589610e999360b734c4cf5c64387c1b6dd62ed50f4c4127dbb3f6655ac57adae29bae8a2cb2c589b092d0a02cd3df726441ef2a152067529cd1e368611fdb3214a2024435868c8d684791e4c0b4efb014cf80efef03c9dee06caccec7bcfd9c56c572981e55b7701a92402b04556a300838f4ac87e4ae3f3fccd2e0ec57310853ba5f2b86293c0684cb6a2d7ec538e4b388441efdba2efa7ea463c61daf216cbb9a8bb0456a18072dfca7f992422accfa9d86e08337e38016f2e08c43c", 0x5, 0xffffffff}, 0x9}, 0x7ff, 0x8, &(0x7f0000003100)={0xffffffffffffff80, 0xd})
r13 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000003180), r12)
sendmsg$auto_NETDEV_CMD_QUEUE_GET(r1, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003240)={&(0x7f00000031c0)={0x54, r13, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@NETDEV_A_QUEUE_ID={0x8, 0x1, 0x8001}, @NETDEV_A_QUEUE_ID={0x8, 0x1, 0xffffffff}, @NETDEV_A_QUEUE_TYPE={0x8, 0x3, 0x9965}, @NETDEV_A_QUEUE_TYPE={0x8, 0x3, 0xfffffffc}, @NETDEV_A_QUEUE_IFINDEX={0x8, 0x2, r11}, @NETDEV_A_QUEUE_TYPE={0x8, 0x3, 0xfffffff9}, @NETDEV_A_QUEUE_ID={0x8, 0x1, 0x4}, @NETDEV_A_QUEUE_IFINDEX={0x8, 0x2, r11}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x810)
openat$auto_fops_x64_ro_(0xffffffffffffff9c, &(0x7f00000032c0)='/sys/kernel/debug/ieee80211/phy14/netdev:wlan1/stations/08:02:11:00:00:00/driver_buffered_tids\x00', 0x40000, 0x0)
capset$auto(&(0x7f0000003340)={0x6ac6, <r14=>r7}, &(0x7f0000003380)={0xc, 0x6, 0x6})
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_LIST(r8, 0xc0505510, &(0x7f0000003400)={0xa, 0x6d2, 0x26, @inferred=r14, &(0x7f00000033c0)={@inferred=r7, 0xfffffffb, 0x8001, 0x101, "b0ca40bba7eb9887e403091607354aefa77665c2ee313625d70e23b4d8431d98c0e4d48276ce5136b26d007e", @inferred=r7}, "f436277002bc24c9710ca7b83d9a4f0e13e9466aac691b6c32b7aa72627ffa00078e115a0962581d759d3484c0a3c7abfc72"})
executing program 4:
close_range$auto(0x2, 0x8, 0x0) (async)
r0 = socket(0x10, 0x2, 0x0) (async, rerun: 32)
r1 = openat$auto_ftrace_event_format_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/events/vmalloc/free_vmap_area_noflush/format\x00', 0x6901, 0x0) (rerun: 32)
mmap$auto(0x4, 0x8001, 0xc2c, 0xff, r1, 0x40000000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="17000000", @ANYBLOB='i\x005'], 0x1ac}, 0x1, 0x0, 0x0, 0x40814}, 0x2004c0c4) (async, rerun: 32)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x4, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008) (async, rerun: 32)
mq_getsetattr$auto(r1, &(0x7f0000000000)={0x7fffffffffffffff, 0xffffffffffffffff, 0x9, 0x3}, &(0x7f0000000180)={0x401, 0x10001, 0x5, 0x3}) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_seg6(0x0, r2)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) (async)
r3 = socket(0x2, 0x1, 0x0) (async)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x37}}, 0x6e)
sendmmsg$auto(r3, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x9, 0x20000000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) (async, rerun: 32)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9) (async, rerun: 32)
syz_genetlink_get_family_id$auto_nl80211(0x0, r3) (async)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) (async)
sysfs$auto(0x2, 0x4c, 0x0) (async)
fsopen$auto(0x0, 0x1) (async)
close_range$auto(0x2, 0x8, 0x0) (async)
unshare$auto(0x40000080) (async)
mmap$auto(0x0, 0x2020009, 0x3, 0x9000000eb1, 0xfffffffffffffffa, 0x8000)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9)
sendto$auto(0x3, 0x0, 0x100000000, 0x8, 0x0, 0x1c)
executing program 4:
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x68100, 0x0)
sysfs$auto(0x2, 0xe, 0x0)
lsm_list_modules$auto(0x0, 0x0, 0x5)
getcwd$auto(0x0, 0xffffffffffffffff)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x15, 0x5, 0x2)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8400)
openat$auto_tap_fops_tap(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
socket(0xa, 0x1, 0x100)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r1 = openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/lru_gen\x00', 0xc0000, 0x0)
pread64$auto(r1, 0x0, 0x7ff, 0x400)
socket(0x1e, 0x1, 0x0)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, 0x0, 0x121900, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/024/001\x00', 0x40001, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd6, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80000001, 0x7, 0x1, 0x9, 0x1, 0xfffffffffffffffe]}, 0x0)
write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0xc, 0x2, 0x6]}, 0x0)
mmap$auto(0xc, 0x20009, 0x5, 0xeb1, 0x405, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x8800)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_SEG6_CMD_GET_TUNSRC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@SEG6_ATTR_DST={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}]}, 0xfffffffffffffe81}, 0x1, 0x0, 0x0, 0x20040050}, 0x20000000)
r3 = syz_genetlink_get_family_id$auto_nfc(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$auto_NFC_CMD_STOP_POLL(r0, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x128, r3, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@NFC_ATTR_VENDOR_DATA={0x4}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0xfff7}, @NFC_ATTR_VENDOR_ID={0x8, 0x1d, 0x7}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x49}, @NFC_ATTR_FIRMWARE_NAME={0x4}, @NFC_ATTR_SE_APDU={0xf3, 0x19, "91412d5d9ba98b943a32eb448b4bcdb968b5342f8dfe35c293f23967ea833f2785b98c7273a8c4eefae0f2bcdfd1b24d923defa2a7d87ab8f3e1cf09f081207ee4a1460b493d4ce468fe0cb6b763cd790af8ffcf609d726453ca7b16813fd61d87587da5c30019d2cab9982b1a856cd783918f687a43d3cb4c024ca81cf5ccf78f1a478fbaad3e2770d4d6dbc4468be22595ffb218cbbd5bff64b3985cf66e3033ecbc2b7831adba97db572fc05f7271beaffb5ad9bef3ac9cd7b62b8712d17acfc3cd00c0530bd643184f6110e56caed5f3f8df7eda0e4ce882c0ce14648ac6cd4fcfc6ad0f6f19ff466a560bdfe4"}]}, 0x128}}, 0x2000c800)
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000340), r0)
executing program 2:
openat$auto_ima_measure_policy_ops_ima_fs(0xffffffffffffff9c, 0x0, 0x2dc08f24db163610, 0x0)
openat$auto_drm_edid_fops_drm_debugfs(0xffffffffffffff9c, 0x0, 0x40901, 0x0)
adjtimex$auto(&(0x7f00000004c0)={0xf332b6e, 0x0, 0x0, 0xfffffffffffffffd, 0xd4, 0x1, 0x6, 0x0, 0x1, 0x368e, 0x2, {0x100000000, 0x10000}, 0x5, 0x6, 0xfffffffffffffffd, 0x1008000, 0x0, 0x9, 0x81, 0xdfffffffffff628e, 0x6, 0xdeb1, 0x808})
socket(0x2b, 0x1, 0x1)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D1\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0xa3db)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x4a801, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000)
openat$auto_uprobe_events_ops_trace_uprobe(0xffffffffffffff9c, 0x0, 0x12000, 0x0)
socket(0x3, 0x5, 0x5)
r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mtd0ro\x00', 0x2000, 0x0)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x1, 0x70bd26, 0x8}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810)
r2 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_OVS_FLOW_CMD_GET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd700001dcdf2503000000040006000c000180080010000400"], 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x800)
ioctl$auto_MTDFILEMODE(r1, 0x4d13, 0x0)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004040}, 0xc800)
r4 = eventfd$auto(0x80)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/suspend_stats/failed_prepare\x00', 0x2400, 0x0)
read$auto(r5, &(0x7f00000002c0)='\x91\xf3\xc5\xe7\xf4\xfc\x8e\xf5\x1a14\x8a\xd9\x9a\x11\xb1\x10q\xdf\x8doi\xfc\x9f\x18\x9a\xd4\x1d\xf7\xc7\xf9\xf8\xa2\xa3\x10Cs]\x01\xfec~\x9c\x9e\xb2\xa5Io\x11\x83\xf2\x06\a\xc0\xca\xcd\x1fHl2\xf4a\x88`\xd8(\x0fR\xb4\xcb\xc9\xf4E\xe8\xdd\xec\x85\xfa\xdc\xd7\x0eZ\xb5\x8f\x06\x89Ss6\x04\x00'/100, 0x5ff15ff9)
readv$auto(r4, &(0x7f0000000380)={0x0, 0x8}, 0x4)
read$auto(r4, 0x0, 0xcc9c)
r6 = socket(0xa, 0x5, 0x84)
sendto$auto(r6, 0x0, 0x401, 0x7f, &(0x7f0000000000)=@generic={0xa, "e2e18340cba8fe80fffe00"}, 0x1c)
r7 = bpf$auto(0x0, &(0x7f0000000000)=@link_update={0xa, @new_map_fd=0x2, 0x7, @old_prog_fd=0x13b}, 0xa3)
mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000)
bpf$auto(0x3, &(0x7f00000001c0)=@query={@target_fd=r7, 0x1, 0x86e6, 0x9, 0x63, @count=0x4, 0x0, 0x6, 0x2, 0x10004, 0xb716}, 0xc)
executing program 1:
r0 = socket(0x2a, 0x2, 0x1)
connect$auto(r0, &(0x7f00000000c0)=@qipcrtr={0x2a, 0xffffffff, 0xfffffffe}, 0x55)
sendto$auto(0x3, 0x0, 0x79, 0x0, 0x0, 0x20)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/swradio12\x00', 0x0, 0x0)
poll$auto(&(0x7f0000000480)={r1, 0xffff, 0x29}, 0x3, 0x8)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x9)
executing program 1:
r0 = socket(0x37, 0x800, 0x106)
setsockopt$auto(r0, 0x1, 0x1, &(0x7f0000000000)='\x98\x00', 0xb559)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
ioctl$auto_UBI_IOCDET(0xffffffffffffffff, 0x40046f41, 0x0)
unshare$auto(0x40000080)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0)
r2 = openat$auto_cpuid_fops_cpuid(0xffffffffffffff9c, &(0x7f0000000500)='/dev/cpu/0/cpuid\x00', 0xad00, 0x0)
r3 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/sctp/rto_beta_exp_divisor\x00', 0xa0081, 0x0)
write$auto_proc_sys_file_operations_proc_sysctl(r3, 0x0, 0x0)
openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/pcmC1D0p\x00', 0x4000, 0x0)
readv$auto(r2, &(0x7f0000000680)={0x0, 0x40200}, 0x3)
ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0)
ppoll$auto(&(0x7f0000000000)={r1, 0x40}, 0x2, 0x0, 0x0, 0x8)
ioctl$auto_SNDCTL_DSP_SYNC(r1, 0x5001, 0xfffffffffffffffc)
modify_ldt$auto(0x1, 0x0, 0x10)
r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x40, 0x0)
r5 = openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/lru_gen\x00', 0xc0000, 0x0)
pread64$auto(r5, &(0x7f0000000040)='\x00\x00\x00\x88\xde\x90\a\'\x9bM\xa0\x848\xbbz(\xe9\x05<\x82\xfe\xe2\xf6 \x0f8\xfb\xa7\xb4\xa0\x9e\xcb\xec\x9e{W\xed>\xe7l\xcb\x90\\/\x84\x99!*\xe3\x99}x\xd4\xa5D\xfa\xe5\xf9od^\xa6', 0x7ff, 0x400)
r6 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
getpid()
r7 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
ioctl$auto_SNAPSHOT_AVAIL_SWAP_SIZE(r7, 0x80083313, &(0x7f00000001c0)=0x6)
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0)
write$auto(r6, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1fd, 0x7, 0xb, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x1, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x8]}, 0x0)
statmount$auto(&(0x7f0000000240)={0x2, @inferred=r4, 0x6, 0x5, 0x6}, &(0x7f00000006c0)={0x6, 0x3, 0x6, 0x9, 0x6, 0xef2, 0x80, 0x3, 0xf6d, 0x8000, 0x3, 0x5, 0x100, 0x10001, 0x8, 0x9, 0x1, 0x10000, 0x0, 0x1, 0x7, 0x44f, 0x7ff, 0xffffff01, 0x5a9d7750, 0x40, 0x81, 0x1c00, 0x3, 0x8, 0xf, [0x9, 0x9, 0xffffffffffffffa0, 0xa787, 0x200, 0x86, 0x6, 0xb8, 0x6, 0x0, 0x4, 0xe, 0x10, 0x400, 0x2, 0x17a8, 0x6, 0x6, 0x40, 0x9, 0xffffffffffffffff, 0x8, 0x3ce3, 0x732c, 0x2cd2, 0x8, 0x5, 0x5a3f, 0x6, 0x1, 0xf94c, 0x1, 0x3, 0x3, 0xd7ed, 0x8, 0xffffffff, 0xe, 0x10, 0xfffffffffffffffa, 0x5, 0x1], "8ed8d1d33690aac3275b5414b077f16708a0bb7bfa96b2d500f35772defa9ecbbc59"}, 0x7, 0x7fffffff)
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/ipc\x00')
mmap$auto(0xc, 0x20009, 0x5, 0xeb1, 0x405, 0x8000)
write$auto(0x3, 0x0, 0xffd8)
listen$auto(0x3, 0x81)
executing program 2:
socket(0xa, 0x801, 0x106)
r0 = socket(0x2b, 0x1, 0x1)
move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000)
mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb1, 0x40000000000a1, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0\x00'})
mmap$auto(0x8000000000000, 0xc4c, 0x29, 0x16, r1, 0x8001)
r2 = openat$auto_proc_pid_set_timerslack_ns_operations_base(0xffffffffffffff9c, &(0x7f0000000080), 0xdaea6d7da654cc89, 0x0)
fsetxattr$auto(r2, &(0x7f00000000c0)='/dev/dma_heap/system\x00', &(0x7f0000000380), 0x7, 0x10001)
close_range$auto(0x2, 0x8, 0x0)
r3 = socket(0xa, 0x801, 0x84)
getsockopt$auto(r3, 0x84, 0x75, 0x0, 0x0)
openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, 0x0, 0x40000, 0x0)
mmap$auto(0x0, 0x9, 0xff7, 0x8000000008012, 0x1000000004, 0x0)
mlockall$auto(0x7)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
madvise$auto(0x0, 0x200007, 0x19)
openat$auto_tracing_pipe_fops_trace(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/tracing/trace_pipe\x00', 0x0, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="2f212abd"], 0x14}}, 0x4000000)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x42, 0x0)
r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/midiC2D0\x00', 0x84200, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
write$auto(r4, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000000)={[0x1ff, 0xd5b, 0xc, 0x37, 0x948a, 0x2, 0x89, 0x1f, 0x3, 0x300000000000604, 0x40080000001, 0x7, 0x6d3c, 0xc, 0xc8c, 0xffffffffffffffff]}, 0x0)
close_range$auto(0x2, 0x8, 0x0)
executing program 3:
socket(0x2, 0x1, 0x106)
shutdown$auto(0x200000003, 0x2)
socket(0xf, 0x3, 0x2)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000580)='/dev/audio\x00', 0x0, 0x0)
add_key$auto(0x0, 0x0, &(0x7f0000000080), 0xb, 0x2df)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mbind$auto(0x2, 0xd8ce, 0x8000, &(0x7f0000000040)=0x9, 0x4, 0x2)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd3e, 0x1, 0x948b, 0x3, 0x95f4da0a, 0xffffffffffffffff, 0x3, 0x5e, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
adjtimex$auto(&(0x7f0000000080)={0x2, 0x0, 0x100, 0x9, 0x0, 0xffffffff, 0x6, 0x0, 0x4, 0x9, 0xe, {0x4, 0x7}, 0x8c, 0x8, 0xda0, 0x0, 0x0, 0x6, 0x8, 0x737, 0x6, 0x6, 0x3})
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
ioctl$auto_TIOCSETD2(0xffffffffffffffff, 0x5423, &(0x7f0000000080))
mmap$auto(0x4, 0x40000000000008, 0xff, 0x9b72, 0x2, 0x8002)
io_uring_setup$auto(0x6, 0x0)
socket(0x2, 0x2, 0x1)
close_range$auto(0x2, 0x8, 0x0)
r0 = socket(0x11, 0x80003, 0x300)
openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x34d802, 0x0)
r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0)
ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$auto(0x3, 0xae41, r2)
ioctl$auto_KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000040)={0x2, 0x0, [{0xda0, 0x400, 0x9}]})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = openat$auto_ima_measure_policy_ops_ima_fs(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0)
write$auto_ima_measure_policy_ops_ima_fs(r3, &(0x7f0000000000)='#', 0x1)
socket(0x2, 0x1, 0x0)
getsockopt$auto(0x100000006, 0x1, 0x28, 0xfffffffffffffffc, 0x0)
setsockopt$auto(r0, 0x107, 0x1, 0x0, 0x8004)
socket(0xa, 0x801, 0x84)
r4 = open(0x0, 0x22240, 0x154)
execveat$auto(r4, 0x0, 0x0, 0x0, 0x1000)
syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0xffffffff, 0x9, 0x3, 0xe, 0x940, 0x1ffde, 0x3, 0x2000000000000006, 0x2, 0x9, 0x5, 0x2, 0x7, 0x8, 0x7, 0x2, 0x3, 0x5, 0x7, 0x0, 0x6, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f]}, 0x1fe, 0x81)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40400c4)
socket(0x2, 0x1, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_TCP_METRICS_CMD_DEL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x100, 0x25, 0x25dfdbfe, {}, [@TCP_METRICS_ATTR_ADDR_IPV6={0x14, 0x2, @rand_addr=' \x01\x00'}, @TCP_METRICS_ATTR_SADDR_IPV6={0x14, 0xc, @remote}, @TCP_METRICS_ATTR_SADDR_IPV4={0x8, 0xb, @remote}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004050}, 0x48004)
r1 = syz_genetlink_get_family_id$auto_netdev(&(0x7f0000000180), r0)
sendmsg$auto_NETDEV_CMD_NAPI_SET(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r1, 0xa02, 0x70bd26, 0x25dfdbfc, {}, [@NETDEV_A_NAPI_GRO_FLUSH_TIMEOUT={0xc}, @NETDEV_A_NAPI_ID={0x8, 0x2, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x128dd477a6a0c06f}, 0x800) (async)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000280), r0) (async)
r2 = openat$auto_evm_xattr_ops_evm_secfs(0xffffffffffffff9c, &(0x7f00000002c0), 0x4000, 0x0) (async)
r3 = open$dir(&(0x7f0000000300)='./file0\x00', 0x400000, 0x9) (async)
r4 = prctl$auto_PR_SET_MM_START_DATA(0xcb6, 0x3, 0xffffffffffffffff, 0x2, 0xb)
move_mount$auto(r3, &(0x7f0000000340)='./file0\x00', r4, &(0x7f0000000380)='./file0\x00', 0x9)
mmap$auto(0x100000001, 0x10, 0xd, 0x7fffffff, r2, 0xf4) (async)
r5 = openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/uid_map\x00', 0x101000, 0x0)
write$auto_proc_uid_map_operations_base(r5, &(0x7f0000000400)="ad352af150e483b0aaa3a4e1c1c554", 0xf) (async, rerun: 32)
fcntl$auto_F_SETOWN_EX(r4, 0xf, 0x7fff) (async, rerun: 32)
r6 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000480), 0xffffffffffffffff)
sendmsg$auto_L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000640)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000600)={&(0x7f00000004c0)={0x128, r6, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_NONE={0xf4, 0x0, "785ca099641d16b7a379a9736b399c9b606c828f1deed5cad4fc3ecb71892bf5b5e627d68f5822824ed7f0f3e73d0d5d7eb9ba8e141c25f33b7a5542f13ba16623620ffa7947c9a02301b6f7b3a3abde2fafbe112ca709059c9312a36f7e7dcf9fbfa576f8e7654dbf6661f4d68429a1a4d5926d96aeaa305e9ef54bf18957b83b3a77b2cd367c5621fa6e00d02a546ba684cad061c6f7a1071c7d4e70f657fafeba25c5419a9275a00310e83b67385770fd515de3a1be42ff985b4b42f4dd0b8819f0a129552eaefac471788e7a632780eba85e88a90e7a3362a0708f49dc236daaf7573283e48bbed8b6338333981f"}]}, 0x128}}, 0xb13568597765d8bb) (async)
openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000680)='/proc/thread-self/numa_maps\x00', 0x4000, 0x0) (async)
r7 = fcntl$auto_F_GETOWN(r4, 0x9, 0x6d)
r8 = pidfd_open$auto(r7, 0x61) (async)
r9 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000700), 0xffffffffffffffff)
shmctl$auto_IPC_SET(0x0, 0x1, &(0x7f0000000800)={{0x7, <r10=>0xee01, 0xee01, 0x7, 0x80000001, 0x5, 0x1}, 0xd546, 0x4, 0x1, 0x7fffffff, @raw=0x7, @inferred=r7, 0xc7b, 0x0, &(0x7f0000000740)="3847cf0359128307359232197f3c31abc4c609b8bfd7424495513c9299e1aa4e909ffbc7d954137007cb3274dd9dd78a7cfac2dc4adc4af69cc2cf70ea2259a230f266510e1a9b6a", &(0x7f00000007c0)="c4b2f0f25802f057562d6ae03d4aac874bfdea657da4bcb31eca962931362b9390791ef1f5189111dd9f72b1cb2cfcc54dced9e6280cb274"})
sendmsg$auto_MACSEC_CMD_UPD_OFFLOAD(r0, &(0x7f0000001040)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001000)={&(0x7f0000000880)={0x75c, r9, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@MACSEC_ATTR_SA_CONFIG={0x26c, 0x3, 0x0, 0x1, [@typed={0x7, 0x93, 0x0, 0x0, @str=')}\x00'}, @nested={0xf8, 0x58, 0x0, 0x1, [@typed={0x8, 0x41, 0x0, 0x0, @uid=r10}, @typed={0x8, 0xd5, 0x0, 0x0, @pid=r7}, @generic="4bdee5d899f20bb18c98b258e3a4ace5f280653d7fc278d56788266cb08a4419e11149c9810f2490bbf60e544295b3064e937c309f0e67bf5f8b8d087c88757baaa31b7d81969a37b6218c8b4cc94283a47f76618550515f79c0a03388fe79062f07c1b9db2c1af9de8f36ca69e93c57b83fc14bdb7833e48ffd21fa73ab5c2154fab3b44dccaf41ddbbee1058485511735653b83bf0f27391fd87ac52bede9b326b93b86e6447ba27a36d07e46108a89ad542b2bacae369c825e48fb2bed12264b1f139", @typed={0x8, 0x52, 0x0, 0x0, @fd=r2}, @typed={0xc, 0x122, 0x0, 0x0, @u64=0x4}, @nested={0x4, 0x56}, @nested={0x4, 0xcc}, @nested={0x4, 0x119}]}, @generic="9a6bf4cc1b40c8aa24980f89d2c5846bf99ff016cfb35d211100964a0133cdbaca03e4f29ee77fcd3df6c4e730a60ba27df8a7d230c03726b259ac334d1dd4be940945ea916325e0d6ea272328b8a245640d367ac40f44371f09299ba6addedc6b8ee4903c1ad17bb9311ec6711820cd830d170f43f950be3d2bdd07", @typed={0x4, 0x672}, @typed={0x4, 0x7b}, @generic="7f09db9f7565944bc119427c95565f97b63f2c310b02ad584ae84dfcfce90556905478c889e23bf336cfbc5fd2e3fa1e38b984fa7e5f35bbee01f90eb54a981e3858d9670f779b1ebe5530cd90bad0adc9d723d6e007c995a179780ca94d030157c05e2886314466827fe2369c93a4f93e28a8ebe5d6f2db5bc4a3194ce47661123001f36e260fec3dfd5b98d00cb4e3d6b658727cfc6ee55f59a57428b6deab8731d153bfb4a50d30b4e1821be606428fc0fdafdc420ab96fdd33d5b550549e47b1e35fb78fa9749ecba1700e3504481c1928a91d2b1a453b4143572d0e2e22c5a3cb16"]}, @MACSEC_ATTR_OFFLOAD={0x2af, 0x9, 0x0, 0x1, [@generic="cab450f5c5d54775b3b1cdf845a4ae4688232378fe609af19282d4e1f54dd8311312ed006d7d82e2cf7d274e26ee333b5b248d2a019f7c84e94bc4f834c21c328cf90a00ca3bb0991c8495f041037efd3d8ed20a76810e956ed5b3eef7def46c9fb3d14570f736749a7a0b548c239debf53427d7922adfcc70b54a7c506c5de2d5ce3292b31692818d37227ed1a5c02c4f107ccddd3edf2fcc8d54ec0937050f1493925240b7632fb341eec85a3c1d2b4725335b144644512176335026a7500185d10cafb25889", @nested={0xd7, 0x113, 0x0, 0x1, [@generic, @generic="5cdc3d788666a3c8f8aff95a214af48e5e8096bdd8a0aa0ae9cdd53ec900072d0eb71029eb6911092372e963d08b27c998d48b4db83f26", @nested={0x4, 0xef}, @typed={0x8, 0x11d, 0x0, 0x0, @u32=0x8237}, @generic="f4850fef7e7be4fdba9db44a37596ded604b5c29a89a4210e375d4a888efd63c2c45f5794356d1c445bf4c9748a4044fd481952a406962e46e12f3ee44b074c87845b96c97504e4c97acda2ec6cd6dcea0324254cbdd17bf5bebce1e0e94659e6859cbda25c2e62cde1b63c82b594e8d059210492eb58762395e8e024942ee0245bb59adb2cbaa191e73a64e60ad1e8b"]}, @nested={0x101, 0x128, 0x0, 0x1, [@generic="4f88d2646f11810fc9fc4f6df74951f01d6691bf9ae047c1146a62c2676c12fbddd0825d258f52efbccdc5dea766819ee2f2acd7be8580340c97d0c86bae979aa0427b12589aeb9340f2c570da7d93a449a2cbd71a395f42eca54ef795533f83b83d6ccfe293d8dc39e03d40a9ad0103bb13389a950da7d7c9cf8f739ab0458d5a8b4b6e3d0d277502a197652a1b03f6f9456f082c193af9711a8f8e49b3955da4b8a33ecafdd60195c7cf3afe4cf98b57a66c04ced02f662a017cedbba00afb57cf7fcc7d934344369316425781d0f553d6dbf0fe97c6fba0f8b96c5ccc8b4221e353a43795f7a73342f14021e26fe56e2bf323c3e18db8ee", @nested={0x4, 0xdd}]}, @typed={0x8, 0x7a, 0x0, 0x0, @fd=r4}]}, @MACSEC_ATTR_OFFLOAD={0x22b, 0x9, 0x0, 0x1, [@typed={0x14, 0x56, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x33}}, @nested={0x48, 0x66, 0x0, 0x1, [@nested={0x4, 0x8d}, @generic="e7f76fbcb01c6bacf12e6be132a37c2c6a2d8b2e07553bca140234f677d7c9534817ef454c99a40232fb2e632996b5d98b482a778240ccbb1b65a94c1dd0c232"]}, @nested={0x68, 0x133, 0x0, 0x1, [@typed={0x4, 0x41}, @typed={0xc, 0xea, 0x0, 0x0, @u64=0x80}, @typed={0x54, 0xd0, 0x0, 0x0, @binary="02886ee4b1615be9db1bec6724ff6ac2dd600817ecbe82ec7f84c6c56f962dadb544571292e99dbebc314d206c614db689a6a7ea9578f265089a272851057c416f5a8d68e7b57f10bb70edb953adea06"}]}, @generic="a9804c63ee4302b3591df5d77245c9ae184a87e92e4fbbd136d89d1697ac456f3f27d5d5413bcddc33fc65549158b3ab237278e096117ff83a272f8eb715b19623b6ffa53e10613fedf1fb9fcc9a6277dc1f24bccd8aaee27bb88b422c15b08302402969275f578b8052e6637ab732afac1565327892d9eb2a802a6893fa4d472da839ebd9f80aaff1a5da68f3b2a2b00a56c8414a19bae417d5af7adcf06802379ad2bc98fccce58fcce1ee07784f88ccf68d1cb370b75ea96037b340d4f69a20a946f26f6ea7d005d60bb98424ad08827ac00bde9e59c6ef3dc82c2278e672518ff2d90fa017b460a73cb265b2f1b102257fcfbd0a4b129fc0b7", @typed={0xc, 0x2e, 0x0, 0x0, @u64=0x5}, @typed={0x59, 0x83, 0x0, 0x0, @binary="beee90dfa2953a5a6b6a3dd38651c8de0ce007d7cd27de249600c864feae6aecea18f77e296e22225585cffb3891fbc701d2f71455d817ac7f80c1c58b63d1fb38e81aedad19ee7d1fbef03c8828f28f06f499980f"}]}]}, 0x75c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
openat$auto_bch_chardev_fops_chardev(0xffffffffffffff9c, &(0x7f0000001080), 0x404700, 0x0)
r11 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001100), r0)
sendmsg$auto_NL80211_CMD_GET_MPATH(r4, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x28, r11, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_HW_TIMESTAMP_ENABLED={0x4}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x14}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x82}]}, 0x28}, 0x1, 0x0, 0x0, 0x20051001}, 0x20000000) (async)
ioctl$auto_XFS_IOC_PATH_TO_FSHANDLE(r8, 0xc0385868, &(0x7f0000002380)={<r12=>r3, &(0x7f0000001200)="cdb8f35d2df8b37484d26de0684f07759c7d09d4593bd2d3a0970739995cdc760270d620ba8ece72ea0ac510ff5964106ec4c378e580c6d3ab2de39cc66475674e0eac0dbe0090a69da0de074e44d4fe11d559c5a8ddb0da14eaac46f56aba556e8c0031ea03f15be37f01218dc0f7f052f63e4651dedd34eda135981aefdc1b5f1d0430c969e730cb197376e2ed783a6535461fab81f689fc72acff4edc703f3adc12044485a6e2b664e22199ab6eb4e025af33655e44e3f7ff2268a5b64f63451c656f6ec139", 0x6, &(0x7f0000001300)="985f8d531c8f48e7d43d5c79eca7c94ada112854c6aa6cb633b737b2eebbe89e00e41fffb39a665d9eae38381696b72d8dd79dec09a9b284c3b9b80a2072c1ed63d635d76ed0a8bed43565d937c31fe38ecfd633a6c81c7419f33c3842d2b80005a2644a7cd8718781c13434159814dc9d2d874f4d065df23b3fb5648ad079d621d0e0a42295fdd69d0c70ae756e06e572dad5c676d4072f94c8c8d293131b6918bf3f256ac4912db105c452f8d5da383a3f77b11882a1184d17c54fdb4e4f86970f9a0c9ca52d22596fdcca642890750bbd12c64fa92769320587829644a441c3b5eabf738ceec711b1103241ceeb18e3bf5491e88a9c15fa804bb6193df3200449e2b9926a16cb5d603c029b9214237ad7347ce746bf580d55f7d5c98e6ed4569c5b616ee0aee8315621cc8c59be1c670711c4842753d0d8a2fcb9efb1f53f4f88d9487660953c498f7bb8dc92704ebd1ef6f83ac5d7042c46a9bd1ab4a7a3ef2f24c841b49c9cf88b0d0186c029562d96e757e0d5a1140735b31de3c0ab2b6eab98d73be28d4e7d23e740b326a45d32e89e989880c2f6891191421b56d756ece77752d04b2d430268685fd9cdad78458fc2b0fc8a7f20fb24efce1709d4349c4aad3c74906822df20c3f3327715b4fcff5ea9b8a9642db2ff0d7da96b76d54a0acfe71f155105190d1a712edd390efb182476bfa576f2b86c959034635cac10d4114bd02edc7bf32f6eecebb157e3fc20a900bec33380b28e2c55761275029bb43d69c306f2414e97516a81c9dd4b4495d637737224348e140d85aeadf26a8a1ce73774b78db114bb9afbdb5857ac8eb2cdf5ade6cf577589372d1fb13b08ad4a72128882acac4189bf9564e4fe81b41883ea72ae6acf542f3efbbd6f5e293a4d959bf1473240c3406dc9b39aed39020c97a280ee675107362e08b27513083367c00c68403f972cefebc8063a396525c31b1d1aecbf47373ea0ab3292cdb31aaada3f886d1200e1305804672ce572622399fb43d182a36194844dc4ac4d3684dca3803eb680013a22ad83ecaf51e9af1fd046bc2645e6cee1dfad854a4752ce3b3e8e3b51d228f77dbf8e660f9b96eb888529cd71472992b97e493b3b37eff2972c45a5ebe58cf08e58907e068880c0ae7a8c12ea6f2446d619e8ae250aa0002e554ac4623a36e69f464f549ac6d629dfaecfc210cd88325f71b339ce785cf6716c5f5fc4b12cb7b28cd3c034d4b5dfe1c75a5948dbba01395e8924d3b8551e0f7af1cb21969c2675fcca547c8bc5304c121ac344170ae3bff95c7aa9d93cc1dc540e02162ab1e083ee0a9a23c3d1272960fad140446bddd6ad057daedd2994498c5dd1b688b8d24440266b5be8fb490201ba142a811a35944d3bc41258541efbfad5ddd02000c648d537746909801f22753c0100ad0a12cc65c8d9c3053ed12671a091e96a474e3641b97a32c28ce291eb3a19ba71ce4ce74bd7973b4338e099c4faba3594274955adb1c050ef33ee5140e5ef0919988cfe0b01fcf5dbd28a90969aa264f08931614848c6e83406b925a514f03a54f3a27b2f7ab2b147d6aa3b2a7efe9e8bc0b7a04b5d6590b1757ca0712a22934563bae40702e63537706a1d4a8a604b89295153a3e052011efcebf547ed64ef5525b034fbab7847e616e2188486d151f62cc57ebad4b5d25568ee8ed102f5d16d9f3b18b10ebcd52b701c9a3ce97d7eed86f59d6b11e97b3092421834ff0b3c86dde7103ffd95c9852348df9df202466a445aa25d00d5b24c5a60b69d7bc345212736f45088ad87723de7df2ede7d4097dafafd946c0312282b02ec448c8d5130a186eee2734b47e5dc37bcd074a72bbb53ffa4ecb2037daea55b7a9407cc3dd8f5bbcda3715d0e87731092d27e9c700b53ba3981f8b14dde8bf15bd652c1e74bbe6a110ecd920d3a0341f7b4e066c3634c706209958a4d47325f3065f8f046c71e7935e987999d7fa40ca8e51715082035f2137485086eb6f71fe5aa5d75d070d0ff6b3c52065da21e2b403f0b4f9e253bc4f68350463f1d10f690e846979fd9288c3732f4a32d2e4cd95aee31c7a6fe2551c7ec7142918b0b51e3f495315839eebf542690e4a2d04ea2bc0aff20a2d9ad53e4db947a218fb56f5af9613719514d0353ffd8a9afee0d37b5c5a092eef702ab25ffebab7058996748da001fc2ac75b0a703111be13cbc748e491643160903e5c6154dcf33432edf3877e49f2845f0e74ce0b1c55bd1cca1564f71d8ec3e9f3d910517da678ea69685ced37f497a1e2020025abbb78cb0b263fc683b2b2e99f5abca8900549a1c942d32cd9bd892b033bb39a0d1cd8628cb232a202e846d117326e7aad788d16df54d8ed5212ea0ac33fe15707ae4414187b57f4cc26559a23147b3033a3b635c44d0553046a491c8b7f37136018d16c84c210fe6e4225f91c9d894978455a3aaec4b8511c50c0ab80959c9d2a77902f6289c6d55e1ba828b4262347992039ebb43e9a96fef76c789e24f8f54db603872cef4e1cbb22e4617cbbe28b4abff18dd9c09b7ba72ff8e321b5c33bbc1d7e07433a331577e0c48a1121cb9ed8d4b737ed4a98d5553caf3f11425c4ab1754578c0e7d2b792b096da093454db66312b632823ed213b7fa1475938e19b29f4ca47686c5644c131723741bb48c066de3e28e9cf7f089ba6ccdb588d71f16d1e531d2d964a2d9f9562b91541f6e3c1e7f73e1a35f2bf65e077929de179744b85efce1ffc7cc2a452c825be6b4f6c6be596f339d5e0740330d24c4b440154611753ea553f8b1bbf3a9f0022ac189fb8449bf75f8b219ff2dac41d8c7b25f2d3404f9b053d2629a19e542fdcc7edfd2405e7121dbd3f9e226518b81f67fb43bd63421cafc83f4f90d15b28b80669fd593f8712e02b63a786a8b56d24efeb2cce2d94bf2388b3a7e617024dff907ce754d4ce23257283963b0b8fb08f538ac9e8f5e9a153adfa9aef72c7846d5efb93fcda709c6e707de63927d5771f3931ef665511fede748de6401aefcbf9a9379c422f8e60bbf60c5830fc08cd41b1fc6a7e7a9a0571ce60d339fc36fb37c9e25ee4a1414100a504941023e4713dd35d03498ef4b1438f3d103e29ca7b7bae42e72ab47059367ce9a4c74c04aa27be90eb17e4a09219699c6436c62a619707ec9159bac92d2d286c54d93855924be64625ac90a728b9822d248849abdb5ffae5c36b60671effde1a783c9b99175fbe1ef5ab682a0f9d65b1fbb4880f4bcc9aa82ef763990659b51b43a9d9fde6a7ff29ca162aac0bd4f129d1f9bc91d1faae39537218583383dbd9cff8b6b292e39c3d975ef4f420bcec57d1a1e32433d6a2ab13ea12e1adefee44e9825bfb65a956444949f0519d7bbc8d29091d894232f1c47c9f67e2fbcf69f0250638fe0181bcd4f3a9b036c1aaef0b8448f58619ef0d40c54f35a277501aa3b61fe93b583d841493d42a1a0228e36c9754b70dfda582aeb34464f22ce530a0689fef7113a46d397cebf4fbd8b58cb1bae639834665708ef7c9561d8a619862380af3a172ff18f959bfbcd7e6b37745fbea3bf17ae432ca180d93dec15ebc4193150fec49ccc97f31595b3e871b6ca0cedb04b14772af2a8aeb326b53d57de9c53c96c44a8fddef19364b5dfe45d4d0da7e48da2092b09ee21eb221fb86f6912cacbdca2e4d20910ca3b1b35d70aa057b5e4cd68f5ad19961ad461701edec8a7a36ca9b439bd1f658873c3f91661f3dd5caed84b36c0353ad88d10341c8ef5403c1ce8abe221e2e82aa242706747311d63c1886fda1fe9439c877e35c442e75468fc8a6057d69c729cb28d706254aa59338e76d98a73928017e44c68872a6c995cf2a3e1d36d77215185663d0916326e0837fbb6abcec098bac6a55b7ceb1d4f2b6eef6c50851db0d62535b9f58d27bac3441eed93cd177edfaf10de89bb80b662fdebd2f4e314613a6f25512408bdc7fccdf7b67e80fb099e5c9a464f40511680adfaed906039a326f8bd484bd71e2108b66f86b427c6f48c3ff688b16a239aa12d3eb2606d8d64b72b5dadb8db42b296658891a1922f40c7d0ad0b33b9b223206f764264d69c734d9c745a4679fd83ef2360657de43f0edcc203289468152e7bfc8c42ca295dd69c824dce842e2b14dc063a0755c5b7190ab0267aad24e331a8cfeab7a99ef95f33ebca89038abf02729b3fc8cb8188db14cbcc6c6e46a2437ef344d06fefb7271f1dfe24234ffcfd2a3586c610efb54017cfb52234a81982d2981813d1791dfa34bd33bf0a6da461de83d08e5c249271a3314daaba9fc988b856f9a2c6d51754c08050326cbf85f601d2dcc62b1fce48a78991f3a52e0f46c6f3df32fc5217c9c9ee1a259e1b5c007919e160449850b53988d16461d2fb9fd042ce9f7744bc62ef59be61bf26cae13e6044edf68d0e0d3ef51772997cf474029429255e398544d57ab81fc2fdc5a0d46b84ed6d567e4a277351b2b22415514d5c6809635cd5d37392a1e886e176bd12099e956dd4177ec1bea1063eee40f6e0b8a81eda5ed6825526e6fe854e7b99167638df64c2341334945ce868cc32636e1b4f7985ebe7104ed7c4e2cd6224fef1563e7b91a4298fb430511bb21990391a12e068e8f3d8e0e35a3f1c6a66c67d445a08f333bbbdba82b3f3f801f2c10d5e69e42765f9972f2431a1b0fe65f9fc162f30841559552e390de9d75dd858e1e8a5b3af34a24120ce0dc69b0ad79d177ec1a98b00bcebd1906e4a9711bb6a876f698532e6624827da6e42c7f1888dbee4ef30626c8ec29b11ff37471d40dd2ddf293339d00aee487d63463c7b5644f142fa4ba7a5594224a170c108601314464dce59144ea6faa543e5bb9d8ad0461e07bde21d3029506213691a5253aa7b18eb51bbfe02fa38cfaa1f6c5ae281a0d75b694a4ab0099f9d53023119b738729c088cb89cb5003581b0a9eea262664f2187cf81cd5dc5fac4d25200584ae3909ffa7d9809a4ee7bc61102ffd649de2e6c3f541a352e9f0de3900ad5ed404e976f4c2e12b1922c1bf0a54c3cf782c1f433a89d32afa8edd4abfaf09d10f7a0a877f05b009f74cd80744b37320c2759d683166e6bc49fe9e359ef8330fb43235a6faf97d47b041eb71f8fc32e5404b51d490b3ff7e15678d4ec582819fc66ba114615dd92f73783e3831c6132a406a236df00bcef5e599f5395d20e57ec6a8a9c0ae4212c47fabd230b13bc955f23bc148e5f2f2f9ead9e5b332d15491d7085701661d55c5a61ec8c40bbd2cbda791e8cb978303eb18b110776c4c29105d7d7f5a36c848ea883364e74180b22f3177dd846088c7a26f2344b5df5025ba1c778b79d7eefd8e42a33996d56743b8739c1a1a3a8981206ddbc6d3d85b3093dc48ad40e25e872f4940422620976085a3bbce8ade5840e7673c6404f840135a5c3b425634ff817b89a90fe2382bfd26b721b9f99ce2ed691449e5c34a59d52e426b893f095f7d754b878cac7b32ea09b610aa09ecab78b0737c2d839d282bb2f46c6c37bb2ef665cdbeea7f81efad8176260b727754562a7508cb21c9006398f7c5f831f84b46c23009abf22a399aa61c308a21bcb8dac2d03e58fb37a5d53a71b8e4483f8e4611501f6c536a170dc3aa5fd4454069237c8e924889d40f319e81a564b6be3ac690fbb795984d90bfe0d5b1bc8379db72c3402c65af0e5d91482072bc3251462a1c9ccedd98f42b09fe6710d97bf5a600d080e7b95add670c68e31b5d98df463971400158b175cf10eebbe", 0x6, &(0x7f0000002300)="23fe33a275653b90c092ad58f03a9e21c377a948f0f873a4980b13d6ac32d0c6757e9454d17582171d4f03bb991667377b80bf", &(0x7f0000002340)=0x6aa0f00a}) (async)
r13 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000002400), r0)
sendmsg$auto_IPVS_CMD_NEW_SERVICE(r12, &(0x7f00000025c0)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x100001000}, 0xc, &(0x7f0000002580)={&(0x7f0000002440)={0x104, r13, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x21, 0x3, 0x0, 0x1, [@generic="7752b2a009b14bbb041e76a8b1585d39d74fc3efc6b88ed6e21e5fbb6d"]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DEST={0xb1, 0x2, 0x0, 0x1, [@generic="97f826ac59c9fe26f125d26dac7b39383f1cba235544004e68282007a58bcd106be224f894b6ba6ef59abb517fa24b40acbd6f52bd33142225078c50d9eef7e5c2b408ceb40619b75a4da8bb81872ea83d6af4607db4c414f8c3063df254146c10c3b0549c0ab5f1a8", @nested={0x43, 0xb8, 0x0, 0x1, [@generic="6d1437edfde92240e2382797624abbb7a5c00a162866d2dae3579cd2a65e72da52dde373a13780bbb4", @generic="9e4965319d399f48d21d61bb277deb57a4a6d5590729"]}]}]}, 0x104}, 0x1, 0x0, 0x0, 0x4800}, 0x20048010) (async)
read$auto(r8, &(0x7f0000002600)='\xa7]*\x00', 0x1ff) (async, rerun: 64)
r14 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000002640)='/dev/sequencer\x00', 0x2, 0x0) (rerun: 64)
ioctl$auto_SNDCTL_MIDI_INFO(r14, 0xc074510c, &(0x7f0000002680)="b2c43d92bb713913f23a06f6020c80d84dcbff2255c6839fb208b75901442e5ec27781c6730db0362b8acc7fa4937e38fb45")
executing program 3:
r0 = openat$auto_tap_fops_tap(0xffffffffffffff9c, 0x0, 0x68a80, 0x0)
mmap$auto(0x100000000, 0x2020007, 0x2000000000000003, 0xeb1, 0xfffffffffffffffa, 0x8000)
io_uring_setup$auto(0x6, 0x0)
r1 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptyy7\x00', 0x102, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
write$auto(r2, 0x0, 0x4fffffdf2)
unshare$auto(0x40000080)
close_range$auto(0x2, 0x8, 0x0)
r3 = openat$auto_bch_chardev_fops_chardev(0xffffffffffffff9c, &(0x7f0000000580), 0x400, 0x0)
ioctl$auto_BCH_IOCTL_FSCK_OFFLINE(r3, 0x4018bc13, 0x0)
fcntl$auto(0xffffffffffffffff, 0x400, 0x1)
unshare$auto(0x40000080)
mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
io_uring_setup$auto(0x6, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x2, 0x3, 0x6)
lsm_list_modules$auto(0x0, 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x7f, 0x4000000000df, 0xeb4, r0, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/advisor_min_pages_to_scan\x00', 0x88282, 0x0)
write$auto(0x3, 0x0, 0xfdef)
socket(0xa, 0x5, 0x0)
open(&(0x7f0000000040)='./file0\x00', 0x8643, 0x15e)
creat$auto(&(0x7f0000000300)='./file0\x00', 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/card1/pcm0c/xrun_debug\x00', 0x4a2202, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x103800, 0x0)
io_submit$auto(0x4, 0x81, &(0x7f0000000140)=&(0x7f00000000c0)={0x6, 0x2, 0x7ff, 0x9, 0x0, r1, 0xc, 0x9, 0x1000000000000000, 0x0, 0x1, r1})
executing program 2:
r0 = socket(0x2a, 0x2, 0x1)
connect$auto(r0, &(0x7f00000000c0)=@qipcrtr={0x2a, 0xffffffff, 0xfffffffe}, 0x55)
sendto$auto(0x3, 0x0, 0x79, 0x0, 0x0, 0x20)
r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/swradio12\x00', 0x0, 0x0)
poll$auto(&(0x7f0000000480)={r1, 0xffff, 0x29}, 0x3, 0x8)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x15, 0x5, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x9)
executing program 4:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x20b42, 0x0)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
r0 = openat$auto_proc_clear_refs_operations_internal(0xffffffffffffff9c, &(0x7f0000000600)='/proc/thread-self/clear_refs\x00', 0x2, 0x0)
r1 = socket(0x10, 0x2, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40000)
recvmmsg$auto(r1, &(0x7f0000000140)={{0x0, 0x1, &(0x7f0000000080)={0x0, 0x400}, 0x5, 0x0, 0x200002, 0x8}, 0x803}, 0xfffffff9, 0x10, 0x0)
write$auto_proc_clear_refs_operations_internal(r0, 0x0, 0xffffff4b)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
socket(0x2, 0x1, 0x106)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x2c, 0x80003, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/mtrr\x00', 0xa8240, 0x0)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22240, 0x55)
socket(0x2, 0x3, 0xa)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x8)
connect$auto(0x3, &(0x7f00000018c0)=@l2tp={0x2, 0x0, @multicast1}, 0x55)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0xe000)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
sendmsg$auto_NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000001fc0)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
modify_ldt$auto(0x1, 0x0, 0x10)
modify_ldt$auto(0x807ff0000000000, 0x0, 0x0)
fcntl$auto(r2, 0x8, 0x1)
fcntl$auto(r2, 0x11, 0x2)
socket(0x2b, 0x1, 0x0)
setsockopt$auto(0xffffffffffffffff, 0x29, 0x3c, 0xffffffffffffffff, 0x1)
connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x3, @rand_addr=0x40020000}, 0x55)
r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, r3, 0x300000000000)
executing program 2:
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/net/bond0/bonding/num_grat_arp\x00', 0xc8282, 0x0)
sendfile$auto(r0, r0, 0x0, 0x1)
mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000)
madvise$auto(0x0, 0x2003f0, 0x18)
r1 = openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/usb/usbmon/12u\x00', 0x589200, 0x0)
setsockopt$auto_SO_BSDCOMPAT(r1, 0xfffffff7, 0xe, &(0x7f0000000040)='({.$^\x00', 0x1)
executing program 2:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
mlock$auto(0x749fd573, 0x204a)
socket(0x21, 0x2, 0x2)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xc, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x7, 0x62, 0x5, 0xa, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff)
socket(0x2, 0x1, 0x106)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
socket(0x2c, 0x80003, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/mtrr\x00', 0xa8240, 0x0)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
close_range$auto(0x2, 0x8, 0x0)
open(0x0, 0x22240, 0x55)
socket(0x2, 0x3, 0xa)
setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x8)
connect$auto(0x3, &(0x7f00000018c0)=@l2tp={0x2, 0x0, @multicast1}, 0x55)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0xe000)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
sendmsg$auto_NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000001fc0)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
modify_ldt$auto(0x1, 0x0, 0x10)
modify_ldt$auto(0x807ff0000000000, 0x0, 0x0)
fcntl$auto(r2, 0x8, 0x1)
fcntl$auto(r2, 0x11, 0x2)
socket(0x2b, 0x1, 0x0)
setsockopt$auto(0xffffffffffffffff, 0x29, 0x3c, 0xffffffffffffffff, 0x1)
connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x3, @rand_addr=0x40020000}, 0x55)
executing program 4:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000)
move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xc2481, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff)
epoll_create$auto(0x400)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0x10, 0x2, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x3, 0x7, 0x6, 0x5, 0x3, 0x2000000000010006, 0x0, 0x7, 0x5, 0x0, 0x7, 0xaf, 0x9, 0x2, 0x3, 0x105, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x1fe, 0x81)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="f2000000", @ANYBLOB='O\x00', @ANYRES16], 0x1ac}, 0x1, 0x0, 0x0, 0x24040840}, 0x94)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xb, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB='*'], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x8002, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x9}, 0x3, 0x4000000)
bpf$auto(0x0, &(0x7f00000001c0)=@task_fd_query={0x9, 0x21eb, 0x7ff, 0x3ff, 0x0, 0x3, 0x5f, 0x0, 0x3}, 0x6f3)
r0 = openat$auto_msr_fops_msr(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cpu/1/msr\x00', 0x1cbf03, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
bpf$auto(0x5, &(0x7f0000000000)=@bpf_attr_3={0x1c, 0xa8b, 0x18c, 0x6a, 0x0, 0x3405, 0x3, 0x9, 0xfffffff5, "63ace816ef77cf00", 0x0, 0x549, 0x4, 0x7, 0x0, 0x1009, 0x4, 0xffffffffffffffff, 0xe, 0x2000005, @attach_btf_obj_fd=0x3, 0x166, 0x1, 0x4000000000006, 0x8, 0x7, 0xa7be}, 0x2007)
readv$auto(r0, &(0x7f00000000c0)={0x0, 0x101d0}, 0x400)
mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb1, 0x40000000000a1, 0x8000)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
fsopen$auto(&(0x7f0000000000)='nlctrl\x00', 0x3)
madvise$auto(0x1, 0x7fffffffff7fffff, 0xc)
mmap$auto(0x0, 0x9, 0x400000072, 0x8b72, 0x1000000002, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
executing program 3:
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000500)='/proc/lockdep_stats\x00', 0x400, 0x0)
socket(0xa, 0x2, 0x3a)
read$auto_proc_iter_file_ops_compat_inode(r0, &(0x7f0000000540)=""/89, 0x59)
mlock$auto(0xfbe8, 0x4)
mlock$auto(0x1a81, 0x2)
mlock$auto(0x7c88, 0x7fff)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff)
sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002d80)={0x40, r1, 0x1b, 0x74bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_PROBE={0x4}, @OVS_PACKET_ATTR_ACTIONS={0x10, 0x3, 0x0, 0x1, [@nested={0xc, 0x17, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic="0ef9f18c"]}]}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f17790485908286dd"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc000)
mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000)
r2 = socket(0x11, 0x2, 0x0)
landlock_add_rule$auto_LANDLOCK_RULE_NET_PORT(r0, 0x2, &(0x7f0000000040)="e6e2927b07109f4ce1068342a0df04bf7c2a6cf09343496e199e28a7da4a56637543e90e0e55fe7a5c0b", 0x4)
ioctl$sock_SIOCGIFINDEX(r2, 0x8905, 0x0)
close_range$auto(0x0, 0xfffffffffffff001, 0x2)
r3 = openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/pcmC1D1p\x00', 0x0, 0x0)
ioctl$auto_SNDRV_PCM_IOCTL_LINK(r3, 0x40044160, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/cgroup\x00', 0x80002, 0x0)
executing program 3:
openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/error_log\x00', 0x503, 0x0)
openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/tracing/error_log\x00', 0x503, 0x0) (async)
executing program 1:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0xd0502, 0x0)
ioctl$auto_SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000000c0))
prctl$auto_PR_GET_SPECULATION_CTRL(0x34, 0x10, 0xffffffffffffffff, 0x8000, 0x8acb)
write$auto(0xffffffffffffffff, 0x0, 0x7)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x80102, 0x0)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYRES16=0x0, @ANYBLOB="2f212abd7800fddb"], 0x14}}, 0x4000000)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000080), 0xa2741, 0x0)
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0xe8ca)
r1 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0)
r2 = open(&(0x7f0000000480)='./cgroup.cpu/cgroup.procs\x00', 0x80842, 0x20)
read$auto(r2, 0x0, 0x1)
ioctl$auto_IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0)
ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, 0x6)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
ioctl$auto_IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r3 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0)
r4 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
ioctl$auto(r3, 0x5609, r4)
mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x2020007, 0xffffffffffffffff, 0xeb1, 0xffffffffffffffff, 0x8000)
ioctl$auto_SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x4c03, 0x0)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x10, 0x2, 0x14)
socket(0x11, 0x3, 0x9)
executing program 3:
mmap$auto(0x0, 0x20009, 0x7fffffff, 0xeb1, 0x401, 0x8000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/nfs/parameters/nfs_idmap_cache_timeout\x00', 0xc2902, 0x0)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3)
bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3) (fail_nth: 90)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL-mlock$auto-socket-select$auto
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
mlock$auto(0x749fd573, 0x204a)
socket(0x21, 0x2, 0x2)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xc, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x7, 0x62, 0x5, 0xa, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
single: successfully extracted reproducer
found reproducer with 28 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL-mlock$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
mlock$auto(0x749fd573, 0x204a)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL-mlock$auto
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
mlock$auto(0x749fd573, 0x204a)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-open-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
open(0x0, 0xeee00, 0x31)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-setsockopt$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-setsockopt$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-connect$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(r2, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-bind$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-socketpair$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
socketpair$auto(0x1e, 0x5, 0xfffffffc, 0x0)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mlockall$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mlockall$auto(0x7)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-write$auto_proc_mem_operations_base-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
write$auto_proc_mem_operations_base(r2, 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-openat$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-madvise$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
madvise$auto(0x0, 0x2000040080000004, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-mmap$auto-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
write$auto(0xffffffffffffffff, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-msync$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-syz_genetlink_get_family_id$auto_ioam6-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000140), 0xffffffffffffffff)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-write$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
r1 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r1, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-openat$auto_snd_rawmidi_f_ops_rawmidi-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY-mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
ioctl$auto_FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000040)={0x0, 0x9, 0xe, 0xc, "9eee0000663407d4"})
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
detailed listing:
executing program 0:
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
r0 = openat$auto_force_devcoredump_fops_hci_vhci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$auto(r0, 0x0, 0xe)
write$auto_proc_mem_operations_base(0xffffffffffffffff, 0x0, 0x0)
mlock$auto(0x10, 0x10)
mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000)
socket(0x21, 0x2, 0x2)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_force_devcoredump_fops_hci_vhci-write$auto-write$auto_proc_mem_operations_base-mlock$auto-mmap$auto-socket
program crashed: KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
reproducing took 1h31m51.933620775s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline]
BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
Read of size 140 at addr ffffc90000ace000 by task kworker/u9:1/5141

CPU: 1 UID: 0 PID: 5141 Comm: kworker/u9:1 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: hci0 hci_devcd_timeout
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 skb_put_data include/linux/skbuff.h:2752 [inline]
 hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
 hci_devcd_timeout+0xb5/0x2e0 net/bluetooth/coredump.c:413
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address ffffc90000ace000 belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc90000acdf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000acdf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000ace000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90000ace080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000ace100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline]
BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
Read of size 140 at addr ffffc90000ace000 by task kworker/u9:1/5141

CPU: 1 UID: 0 PID: 5141 Comm: kworker/u9:1 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: hci0 hci_devcd_timeout
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105
 skb_put_data include/linux/skbuff.h:2752 [inline]
 hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258
 hci_devcd_timeout+0xb5/0x2e0 net/bluetooth/coredump.c:413
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address ffffc90000ace000 belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc90000acdf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000acdf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000ace000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90000ace080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000ace100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================