Extracting prog: 6m1.885797264s Minimizing prog: 1h15m50.860083481s Simplifying prog options: 0s Extracting C: 1m45.963025876s Simplifying C: 25m18.880122323s extracting reproducer from 65 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-landlock_create_ruleset-landlock_restrict_self-syz_open_procfs-socket$inet_udplite detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) landlock_restrict_self(r7, 0xe) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') socket$inet_udplite(0x2, 0x2, 0x88) program did not crash single: failed to extract reproducer bisect: bisecting 65 programs with base timeout 30s testing program (duration=46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [36, 30, 10, 6, 30, 30, 30, 30, 10, 2, 30, 5, 25, 25, 16, 20, 14, 30, 20, 20, 20, 13, 26, 26, 10, 9, 30, 30, 17, 7, 30, 30, 14, 10, 10, 24, 7, 2, 22, 19, 28, 6, 22, 23, 9, 7, 24, 22, 30, 19, 2, 22, 30, 6, 3, 11, 8, 40, 24, 30, 6, 19, 4, 9, 22] detailed listing: executing program 4: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000080)=@conn_svc_rsp={0x0, 0x0, 0xa, "e23460c8", {0x3, 0x100, 0x0, 0x6, 0x7ff, 0x5, 0x6}}) (async) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000080)=@conn_svc_rsp={0x0, 0x0, 0xa, "e23460c8", {0x3, 0x100, 0x0, 0x6, 0x7ff, 0x5, 0x6}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="580000000206030000000000000000e5ff0000000c00078008001240000000000500010006000000050005000a0000000500040000000000090002007379f9000000000012000300686173683a6e657c2c706f72e61f2018"], 0x58}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x19, 0x64, 0xd4, 0x8, 0x1a86, 0xe092, 0x533f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x2, 0x0, 0x10, 0x3, [{{0x9, 0x4, 0x1f, 0x2, 0x2, 0xe9, 0x17, 0xf3, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_connect(0x5, 0x57, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) (async) r4 = syz_usb_connect(0x5, 0x57, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0), 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r5, 0x0, 0x0}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="186000000000000000000000000000001857000000000000000000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="186000000000000000000000000000001857000000000000000000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x94) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000080)={0x0, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x4, @empty}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) recvfrom$l2tp6(r6, 0x0, 0x0, 0x40000002, 0x0, 0x0) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) read(r6, &(0x7f0000000300)=""/212, 0xd4) (async) read(r6, &(0x7f0000000300)=""/212, 0xd4) syz_usb_control_io(r3, 0x0, 0x0) (async) syz_usb_control_io(r3, 0x0, 0x0) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r8, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c0000000000000000000000070000004415"], 0x30}, 0x40880) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000002c0)={0x20, 0x14, 0x2, 'O)'}, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8, 0xffffffff}, 0x10) (async) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8, 0xffffffff}, 0x10) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="201000001a0001000000000000000000022020000000000000000000041008"], 0x1020}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400018000000009040000010300000009210500000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000780)={0x0}, &(0x7f00000007c0)=0xc) prlimit64(r1, 0xd, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x6) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x2179, 0x77, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0x1, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$hid(r2, &(0x7f0000000300)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0xea41bece6959855b, "2b415490"}]}}, 0x0}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) (async) pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (async) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r4, r7, 0x53, 0x0) (async) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0xfffffffffffffff6, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000000080)={0x0, 0x100f, 0x1, @discrete={0xfffffffe, 0x7fff}}) r9 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r9, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) recvmmsg(r9, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000180)=""/175, 0x27}], 0x1, &(0x7f0000001fc0)=""/65, 0xffffffffffffff4b}, 0x40000001}], 0x1, 0x40002122, 0x0) (async, rerun: 64) sendmsg$tipc(r9, &(0x7f0000000100)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x1, 0x2}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000003c0)="4a7b8798bfca14184162d5034c19d47d14bb527280d9c4e50f", 0x19}], 0x1}, 0x2000c8c0) (rerun: 64) write$binfmt_script(r7, &(0x7f0000000800)={'#! ', './file0'}, 0xb) (async) tee(r6, r5, 0x9, 0x8) (async) syz_usb_control_io$hid(r0, &(0x7f0000000640)={0xfffffffffffffe50, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYRESHEX=r6], 0x0}, 0x0) (async, rerun: 32) syz_open_dev$I2C(&(0x7f00000005c0), 0x3, 0x0) (rerun: 32) r10 = syz_usb_connect$rtl8150(0x1, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r10, &(0x7f00000001c0)={0x14, &(0x7f00000000c0)={0x0, 0x2, 0x55, {0x55, 0xd, "d38bd417e45c96573200dabc506728954d6536413576121f42865ec0ac1f0b3a4f55356825adf9758a0af1a8cb2637b79d9d80548baed6530e9ad64a8d1719403d76a75d4169d10ebe4ee0a637507a4b0fb17b"}}, &(0x7f00000006c0)=ANY=[@ANYBLOB="0003350000003503a4ea7b9335dc523f853c3c9d32122b48f1161b558de8e1d15d2f5850df2b380607e33e9e7c902e97f266bad9eadbeb13c4d87b8662b88fee9528653c27ea7d986d9131d093787bb3ad2558a99b51284d216f348d8d1bf205d5a0aab154d08e138e105624d2a41a062424373ba96cbffa80943a7f1d032ffb4b2ae5fbc357c911f40f8a"]}, &(0x7f0000000400)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="001727000000d5d370c0d90a4fb96ebfdd7020ce3740e5ed2478b8c00000000000000007348c429528bbaa400e"], &(0x7f0000000280)={0x0, 0xa, 0x1}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x20}, &(0x7f0000000340)={0xc0, 0x5, 0x5, "630b1be9c2"}, &(0x7f0000000380)={0x40, 0x5, 0x2, "9011"}}) (async) syz_open_dev$vcsa(&(0x7f0000000440), 0x5f, 0x145000) r11 = socket(0x2, 0x80805, 0x0) (async, rerun: 32) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) (rerun: 32) syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, &(0x7f0000000000)=0x8) executing program 4: syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd69010000001406fffe800000000000000000000039fe8000000000000000000000000000aa4e224e24000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51c2"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_BACKUP_PORT={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00db6072000001ea89de2b4410000e60080b8785d96000010000000000000000000000000000000000052700080ff00", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000000000000000000100", [0x0, 0x2000000000001]}}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) mount$fuseblk(0x0, 0x0, 0x0, 0x24000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x1) sendmmsg$inet6(r0, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) (async) ppoll(&(0x7f0000000040)=[{r0, 0x240}], 0x1, 0x0, 0x0, 0x0) (async) sendmmsg$inet(r0, &(0x7f0000002a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000011) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000858cbf85e308f16fac0000000000000079266c2f1df489b200831e164b448a0a7f143b12c25e7ae4ade2f7719f2dd035ab1966d2ef7634b1378232b4aeda01eddcc5d4d342e059f22f4906801a630f0525b8a6b8574e5beb642128a1d4085e5e222b7750e6e8cc69011fb8c01fec"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000000)="63ec33c9e9b98600000000000000", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x30) (async) r2 = socket(0x2, 0x80805, 0x0) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f00000000c0)=0x10) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, 0x0, &(0x7f0000000040)) (async, rerun: 32) io_setup(0x3, &(0x7f0000000600)=0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) (async) io_submit(r5, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r4, 0x0, 0x3ad, 0x7}, 0x10) (async) r6 = fanotify_init(0x20, 0x0) (async, rerun: 32) r7 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) r8 = dup(r7) fanotify_mark(r6, 0x8, 0x20, r8, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x1, &(0x7f0000000200)=[{0x6, 0x3, 0x9, 0x4}]}) map_shadow_stack(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000000000000) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r9, 0x29, 0x100000000001f, &(0x7f00000005c0)=0x1, 0x4) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008011}, 0x880) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c2bd0b20f8061b3039bb0102030109021b0001000000000904"], 0x0) executing program 4: syz_clone3(&(0x7f0000000080)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = socket(0xa, 0x3, 0x3a) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000440)=0xff, 0x4) ioctl$SIOCPNGETOBJECT(r1, 0x89e0, &(0x7f0000000040)) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000340)={r0, &(0x7f0000000200)='\x00', 0xa800, &(0x7f0000000240)={@align=0x80000001, {0xf04a, 0x8000, 0x7, 0x75ba}}, 0x2, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000300)=0x9}) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e22, 0xa, @loopback, 0x8}}}, 0x84) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @empty, 0xfffffffe}, 0x1c) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000200), 0x4) pidfd_getfd(r0, r0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000e00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a40)=@newtaction={0x98, 0x30, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x2, 0x0, 0xfffffffe}, 0x2, r8}}]}, {0x4, 0xa}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x98}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x0, 0x24, 0x200, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x6, 0x7}, {0x9, 0xfff2}, {0x5, 0x9}}, [@TCA_EGRESS_BLOCK={0x0, 0xe, 0x9}, @qdisc_kind_options=@q_hfsc={{}, {0x0, 0x2, @TCA_HFSC_RSC={0x0, 0x1, {0x4c5a4f29, 0x4, 0x8}}}}, @TCA_RATE={0x0, 0x5, {0x4c, 0x5}}, @qdisc_kind_options=@q_tbf={{}, {0x0, 0x2, [@TCA_TBF_RTAB={0x0, 0x2, [0x5, 0x0, 0x9, 0x8000, 0x5, 0x7f, 0x2, 0x8000, 0x6, 0x40, 0xf79c, 0x5, 0x8, 0x8, 0x8, 0x1, 0xcc6, 0x360, 0x6c, 0x1, 0x2, 0x3, 0x7, 0x100, 0x3, 0x1ea, 0x3, 0xffffffff, 0x4, 0x10, 0xff, 0x7, 0x6, 0x0, 0x4, 0x1, 0x60000, 0x8, 0x3, 0x5, 0x4, 0xfffffff9, 0x1, 0x9, 0x9, 0x7, 0x18, 0x3, 0x6, 0x3ff, 0x8, 0x0, 0x3, 0x8000, 0x8770, 0x101, 0x200, 0xff, 0x9, 0x8, 0xffff, 0x101, 0x6, 0x11, 0x3, 0x1, 0x7, 0x8, 0x8, 0x1, 0x1, 0x7fff, 0x7fff, 0x28, 0x9, 0x7, 0x2, 0x5, 0xdb9d, 0x3, 0x1ff, 0x0, 0x0, 0x7, 0x9, 0x959d, 0x8, 0x6, 0x8, 0x7, 0x496, 0xc046, 0x85da, 0x1, 0x1, 0x1, 0x8, 0x8, 0x7, 0x3, 0x3, 0x5a5, 0x9, 0x7f, 0xc, 0x4, 0xffffffff, 0x3ff, 0x4d, 0x5a8, 0xffffff01, 0x0, 0xd6, 0xdd, 0x9, 0x5, 0x7, 0x4, 0xf6, 0xffffffea, 0x6, 0xfffffffb, 0x5, 0x9, 0x7, 0x41b6, 0x6, 0x8, 0x9, 0x6, 0x0, 0x9, 0x7, 0x0, 0x3, 0x2, 0x6, 0x1, 0x7, 0xfffffff0, 0x4b, 0x1000, 0x4, 0x1, 0x80000000, 0x10000, 0x5ddb, 0x4, 0x705, 0x3, 0x82b, 0x4, 0x7, 0x1, 0x6, 0x2, 0x127, 0x4, 0x200, 0x495, 0xff, 0x1ff, 0x4, 0x7, 0x3, 0x7, 0x7fffffff, 0x4, 0xfffffffd, 0x5, 0x7ede, 0x6, 0x5, 0xbd, 0xa, 0x3, 0x4, 0x7fff, 0x2, 0x10, 0x101, 0x5, 0x186a0dee, 0x5, 0x8, 0xfffffffc, 0xb4, 0x800, 0x0, 0x80000001, 0x3, 0x99, 0x7, 0x1000, 0x7, 0x0, 0x84c9, 0xffffffd4, 0x8, 0x4, 0x3, 0xcdf8, 0xfff, 0x9, 0x1, 0x6, 0x6, 0x407, 0x1, 0x1, 0x9, 0xfffffffa, 0x8000, 0x0, 0x7ff, 0x800, 0x3, 0x9, 0x1, 0x8000, 0x4, 0xcba3, 0x8001, 0x10, 0x1d, 0x0, 0x200, 0x7, 0x5, 0x9, 0x0, 0x45ca363, 0xad0e, 0x2, 0x0, 0x5, 0x3, 0x5, 0x0, 0x1, 0x7, 0x0, 0x1, 0x3, 0xfff, 0x4, 0x4, 0x4, 0xffffffff, 0x162a, 0x4, 0x40, 0x6, 0x9, 0x10001, 0x40]}, @TCA_TBF_PARMS={0x0, 0x1, {{0xa, 0x1, 0x10, 0xf, 0x6, 0x1}, {0x10, 0x2, 0xfff, 0x9d, 0x1000, 0xfffffffd}, 0xffff4d40, 0x5, 0x1912}}, @TCA_TBF_RATE64={0x0, 0x4, 0x7de5c72136dc0fb0}, @TCA_TBF_BURST={0x0, 0x6, 0x3}, @TCA_TBF_PRATE64={0x0, 0x5, 0xe93c3cca0a7da2b}, @TCA_TBF_BURST={0x0, 0x6, 0xd}, @TCA_TBF_RATE64={0x0, 0x4, 0xa85e5c5f8d2c20f2}, @TCA_TBF_PARMS={0x0, 0x1, {{0x3, 0x0, 0x4, 0x3, 0x0, 0x7}, {0x3, 0x0, 0x9, 0x65, 0xe42, 0x80ac}, 0x9, 0xbe0, 0xfc3}}]}}]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) r11 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2800) preadv(r11, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) write$RDMA_USER_CM_CMD_SET_OPTION(r9, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_tos={0x0, r10, 0x1000000, 0x3}}, 0x20) setuid(0xee01) executing program 32: syz_clone3(&(0x7f0000000080)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = socket(0xa, 0x3, 0x3a) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000440)=0xff, 0x4) ioctl$SIOCPNGETOBJECT(r1, 0x89e0, &(0x7f0000000040)) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000340)={r0, &(0x7f0000000200)='\x00', 0xa800, &(0x7f0000000240)={@align=0x80000001, {0xf04a, 0x8000, 0x7, 0x75ba}}, 0x2, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000300)=0x9}) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e22, 0xa, @loopback, 0x8}}}, 0x84) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @empty, 0xfffffffe}, 0x1c) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000200), 0x4) pidfd_getfd(r0, r0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000e00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a40)=@newtaction={0x98, 0x30, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x2, 0x0, 0xfffffffe}, 0x2, r8}}]}, {0x4, 0xa}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x98}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=@newqdisc={0x0, 0x24, 0x200, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x6, 0x7}, {0x9, 0xfff2}, {0x5, 0x9}}, [@TCA_EGRESS_BLOCK={0x0, 0xe, 0x9}, @qdisc_kind_options=@q_hfsc={{}, {0x0, 0x2, @TCA_HFSC_RSC={0x0, 0x1, {0x4c5a4f29, 0x4, 0x8}}}}, @TCA_RATE={0x0, 0x5, {0x4c, 0x5}}, @qdisc_kind_options=@q_tbf={{}, {0x0, 0x2, [@TCA_TBF_RTAB={0x0, 0x2, [0x5, 0x0, 0x9, 0x8000, 0x5, 0x7f, 0x2, 0x8000, 0x6, 0x40, 0xf79c, 0x5, 0x8, 0x8, 0x8, 0x1, 0xcc6, 0x360, 0x6c, 0x1, 0x2, 0x3, 0x7, 0x100, 0x3, 0x1ea, 0x3, 0xffffffff, 0x4, 0x10, 0xff, 0x7, 0x6, 0x0, 0x4, 0x1, 0x60000, 0x8, 0x3, 0x5, 0x4, 0xfffffff9, 0x1, 0x9, 0x9, 0x7, 0x18, 0x3, 0x6, 0x3ff, 0x8, 0x0, 0x3, 0x8000, 0x8770, 0x101, 0x200, 0xff, 0x9, 0x8, 0xffff, 0x101, 0x6, 0x11, 0x3, 0x1, 0x7, 0x8, 0x8, 0x1, 0x1, 0x7fff, 0x7fff, 0x28, 0x9, 0x7, 0x2, 0x5, 0xdb9d, 0x3, 0x1ff, 0x0, 0x0, 0x7, 0x9, 0x959d, 0x8, 0x6, 0x8, 0x7, 0x496, 0xc046, 0x85da, 0x1, 0x1, 0x1, 0x8, 0x8, 0x7, 0x3, 0x3, 0x5a5, 0x9, 0x7f, 0xc, 0x4, 0xffffffff, 0x3ff, 0x4d, 0x5a8, 0xffffff01, 0x0, 0xd6, 0xdd, 0x9, 0x5, 0x7, 0x4, 0xf6, 0xffffffea, 0x6, 0xfffffffb, 0x5, 0x9, 0x7, 0x41b6, 0x6, 0x8, 0x9, 0x6, 0x0, 0x9, 0x7, 0x0, 0x3, 0x2, 0x6, 0x1, 0x7, 0xfffffff0, 0x4b, 0x1000, 0x4, 0x1, 0x80000000, 0x10000, 0x5ddb, 0x4, 0x705, 0x3, 0x82b, 0x4, 0x7, 0x1, 0x6, 0x2, 0x127, 0x4, 0x200, 0x495, 0xff, 0x1ff, 0x4, 0x7, 0x3, 0x7, 0x7fffffff, 0x4, 0xfffffffd, 0x5, 0x7ede, 0x6, 0x5, 0xbd, 0xa, 0x3, 0x4, 0x7fff, 0x2, 0x10, 0x101, 0x5, 0x186a0dee, 0x5, 0x8, 0xfffffffc, 0xb4, 0x800, 0x0, 0x80000001, 0x3, 0x99, 0x7, 0x1000, 0x7, 0x0, 0x84c9, 0xffffffd4, 0x8, 0x4, 0x3, 0xcdf8, 0xfff, 0x9, 0x1, 0x6, 0x6, 0x407, 0x1, 0x1, 0x9, 0xfffffffa, 0x8000, 0x0, 0x7ff, 0x800, 0x3, 0x9, 0x1, 0x8000, 0x4, 0xcba3, 0x8001, 0x10, 0x1d, 0x0, 0x200, 0x7, 0x5, 0x9, 0x0, 0x45ca363, 0xad0e, 0x2, 0x0, 0x5, 0x3, 0x5, 0x0, 0x1, 0x7, 0x0, 0x1, 0x3, 0xfff, 0x4, 0x4, 0x4, 0xffffffff, 0x162a, 0x4, 0x40, 0x6, 0x9, 0x10001, 0x40]}, @TCA_TBF_PARMS={0x0, 0x1, {{0xa, 0x1, 0x10, 0xf, 0x6, 0x1}, {0x10, 0x2, 0xfff, 0x9d, 0x1000, 0xfffffffd}, 0xffff4d40, 0x5, 0x1912}}, @TCA_TBF_RATE64={0x0, 0x4, 0x7de5c72136dc0fb0}, @TCA_TBF_BURST={0x0, 0x6, 0x3}, @TCA_TBF_PRATE64={0x0, 0x5, 0xe93c3cca0a7da2b}, @TCA_TBF_BURST={0x0, 0x6, 0xd}, @TCA_TBF_RATE64={0x0, 0x4, 0xa85e5c5f8d2c20f2}, @TCA_TBF_PARMS={0x0, 0x1, {{0x3, 0x0, 0x4, 0x3, 0x0, 0x7}, {0x3, 0x0, 0x9, 0x65, 0xe42, 0x80ac}, 0x9, 0xbe0, 0xfc3}}]}}]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) r11 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2800) preadv(r11, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) write$RDMA_USER_CM_CMD_SET_OPTION(r9, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_tos={0x0, r10, 0x1000000, 0x3}}, 0x20) setuid(0xee01) executing program 1: r0 = socket(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x7e, 0x9e, 0xb4, 0x10, 0x54c, 0x38, 0x16f5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x8, 0xc5, 0x38}}]}}]}}, 0x0) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x800) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000180)={0x2c, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000400)={0x1c, 0x0, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x5}, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1101, 0x1}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) (async) r3 = socket(0x200000000000011, 0x2, 0xd) getsockopt$packet_int(r3, 0x107, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa1c92000) (async, rerun: 32) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async, rerun: 32) getdents64(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) (async) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000180)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000480)={@host}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a4, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r5, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000780)=r6, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) executing program 1: r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) r1 = syz_open_procfs(r0, &(0x7f0000000040)='fdinfo/4\x00') seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) getdents(r1, 0x0, 0x0) getpid() (async) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) (async) syz_open_procfs(r0, &(0x7f0000000040)='fdinfo/4\x00') (async) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) (async) getdents(r1, 0x0, 0x0) (async) executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c041}, 0x400c0c0) syz_emit_ethernet(0x26, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @generic={{0x6, 0x4, 0x0, 0x20, 0x18, 0x6f, 0x0, 0x9, 0x1, 0x0, @rand_addr=0x64010102, @remote, {[@timestamp={0x44, 0x4, 0xe1, 0x0, 0xd}]}}}}}}, 0x0) executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000280)=""/196, 0xc4}], 0x1, 0x8, 0xffffffff) bind$netlink(r0, &(0x7f0000000500)={0x10, 0x2000, 0x25dfdc01, 0x1}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x2000, 0x25dfdc01, 0x80000000}, 0xc) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xfd, 0x7fff0003}]}) close_range(r3, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x2, 0x300) r4 = socket$inet(0x2, 0x801, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x80002, 0x7f) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r9, 0x0) executing program 1: r0 = syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733334d2f866f7b543eb2e00000904000003010009cd8d1f0002000000099d53020000fcffff09058b0420"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="40000f0000000116e0875a3c3ec2a965ee06c6b786"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b14, 0x0) executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) (async) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x6, 0x32, 0xffffffffffffffff, 0x55f52000) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x6, &(0x7f0000000000)=0x9, 0x8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000000)={{@my=0x1, 0xffffffff}, @local, 0x0, 0x0, 0x8000000, 0x0, 0x6, 0x7fc}) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x4) (async, rerun: 32) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) get_robust_list(r1, &(0x7f00000004c0)=&(0x7f00000003c0)={&(0x7f0000000280), 0x0, &(0x7f0000000340)}, &(0x7f0000000500)=0xc) (async) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) executing program 33: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) (async) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x6, 0x32, 0xffffffffffffffff, 0x55f52000) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x6, &(0x7f0000000000)=0x9, 0x8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000000)={{@my=0x1, 0xffffffff}, @local, 0x0, 0x0, 0x8000000, 0x0, 0x6, 0x7fc}) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x4) (async, rerun: 32) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) get_robust_list(r1, &(0x7f00000004c0)=&(0x7f00000003c0)={&(0x7f0000000280), 0x0, &(0x7f0000000340)}, &(0x7f0000000500)=0xc) (async) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2e04, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xcb) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYBLOB="bbd4a06e0b862d4bca468a1e55d80867d171d4a64c1033927f2d22a5b3bee4a44709"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e110b07"], 0xec) r1 = socket(0x840000000002, 0x3, 0x100) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r1, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2e04, 0x0) (async) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xcb) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYBLOB="bbd4a06e0b862d4bca468a1e55d80867d171d4a64c1033927f2d22a5b3bee4a44709"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e110b07"], 0xec) (async) socket(0x840000000002, 0x3, 0x100) (async) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) (async) sendmmsg$inet(r1, &(0x7f0000005240), 0x4000095, 0x0) (async) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), 0xc) (async) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000540)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000258f88)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x96, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) msgsnd(0x0, &(0x7f00000003c0)={0x2}, 0x8, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x0, r8, r7, r8, 0x100, 0x9}, 0x0, 0x0, 0x5, 0x2, 0x6, 0x8, 0x8, 0x45b, 0x6, 0x4, r6, r6}) executing program 2: r0 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x3b90, 0x4) (async, rerun: 64) sendmmsg(r0, &(0x7f0000000bc0)=[{{&(0x7f0000000400)=@qipcrtr={0x2a, 0x1, 0x4001}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000100)="d479183d7d98d181a4b5f3e38100", 0xe}], 0x1}}], 0x1, 0x24044015) (rerun: 64) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2002, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x8, 0x4b}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x10, 0xcd, [0x2, 0x9, 0x7, 0x6, 0x401, 0x7]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4) (rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x18483, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_emit_ethernet(0x2e, &(0x7f0000000140)={@random="97fa9587e01e", @broadcast, @void, {@ipv4={0x800, @igmp={{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}, @multicast1, {[@generic={0x44, 0x4, "4dfb"}]}}, {0x11, 0x0, 0x0, @multicast1}}}}}, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f0000000680)={0x81, 0x0, 0x2}) (async, rerun: 64) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r2, 0x4068aea3, &(0x7f0000000000)={0xed, 0x0, 0x5}) (async, rerun: 64) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x6, 0x2, 0xf5, '\x00', 0xf}, {0x1, 0x9, 0xc, '\x00', 0xf8}, {0x0, 0x5, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x9b, 0x6, 0xf}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x7, '\x00', 0xdd}, {0x7f, 0x1, 0x5, '\x00', 0x21}, {0xfe, 0x3, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0xa, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x11, 0xae, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x6, 0x80, 0x1, '\x00', 0x5}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="791298000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c650000000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e80100008000000000887a5ad103649afa17690884f800031e03a6d1bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000000000000000005f37d83f84e98a523d80bd0d0d703f37ca363f601ae899a56715a0a62a26a0f6a5480a55c22fe394ae0000000000000000000000000000437d57defb79ea000500000000000000000000f014a4a318ba48d35ae9f438000000000000db894b62a614cb1fdd46619c5d2200000000000700000000000000000000006dcd2f421400f69947e4f26e099c9e8369080663c909b7e7c87e3b5e8e5a6df77c8f7338cd5a85f211a41b5d529d4243e47d7ab0d5991756b59d363ba30b18fc2ff189a4e8db38ab97c6a125e2785619e84c6a2b50f0e3ff83ef5149aff43dc899fdebdc2c496e6bdd4dd4d21f06fe133f4444272c5f0839ad663100452a6c6b6421f7e89a33b339401eee2cd466ab2a93a1ee7fb8a9e455ba1c6e17b02a1cd7bf35d36cf5b2a0f063469ae0d0b9fc042b48e98626eb0f9754d8cbbefa3079fe63063047baff09e9aaf7600000fba9a88db9ebef86f7cb522a784bb6d37e5f802757a15c6735138b493db9df53440a63fc565a0b190a710ae1e6807cbeb415ac841e94b706974160a60a14e571274f333d23186143b95514c79b50994cb39cda343bda8f01cf8ec7cdfdace0289e83ce50a57d69bfecfaf69fe7ff5b0375a47d3eb57b41d8a0589b82a1cf1149ba3f21ea2b65433321eb1a6f04ecc713c2b26d27baa49e54c2babec86335b9f418b5a5eb997bc9dd65197124b9aa80fc4aa8defb986bf05c41b919886bb81ecd3d24cf9ecc7004000000000000002c70d32f5d55ef2a2cf7560cb2884f46a92b3c25550f73e407fc5d514b2b7a6b690e290e676266addb7d96e723dec9c418eec8c48dffb6f432b4d5fef16e4f0051ba7efc690022c3f62b37cb5682d8bfdfc637ad3bf089ef0117bcd395322fcfb8e8e0a6e2babceb5f289b1d991770681192bcd0b584c3497e455f30ab918a690514a87a7d8e1d5f169a4e680e9c390071d26f2e0e26fc062f2785f14c0404fe01fb4000000000000000577dcb1698a9021a36d73ed03651c1937b2c84046023a1a0a87b208e33ad2d7c2892b176877264e1d699b7401eb917b289f6f67060fda0fa44b54bd87517a2bf09dba7209e41db4288b61bda5960952c45e5c55f2cd68bf9c6ff33e46109584bf42e8696ef1876564fef6f24cbbed0db8ab7fda1ffcc8c9fd4ab2cbe8f8df8e5535b12a942a948eacdaf308d48932064cfc3329da74f6f3e4409d6764a29680e312bf1a0143180e6493c9201ea916e6c9b2566c558ad88d9f7c0aebf82f5807eecefa97ada9bbd9e478e5d7748ee188bc719ca7a73dce5b6758a767c4c6b7572ab25eb2d73986379d5685cb438fe7091d097cc8f33fc0f83dee76603d6580f1c8fc4c37efd305ccc5a25678180425718bb9344e60dda8dae2677bb602d29aa0810616a2fdbca7020d72291b592b84223e2522ee01f5bdaa0fc4eb8d71d948a2baccf3ea2aa79d4d9069d8c0000000000000000000000321cd67859b4567badee56f158406f08683bdc5ffe2dedc916000c71f922fa2dfead7535999436a4aeb908781893479319b8b55e00d90ae6f09f06be2a0fc0bc17bef53331208112a0132350c0c5dd4607547079acc9471300dea6ae01742dccdae69f932cef80bca1bfcb57b9c852cf8358a580044772a80f20de36f707385380155be8907029d039a1d1447fc06b7020221e0d439f3f47edcf12f913dc8b6389a540340ae37804728ea65352e630c2e90424d58d72fdc1b28403e1dc7aad238b81df3b2d4166d656c6a9c73554bdf4f7312a4c0271e0eb45b4a596b7fa928ac3683f09fdaca46226c1df2c6c866cb4412d17d3d52c38cf0f7bd3b0eea2d4e06d061bb1b7c8c52f37f4036932d00028abd4527f5649bd60df638596fd639d7b16860033754ab13419429e5e39f290751ab6bd9392aef5519cd8c16e1f1cb1f225cc84a1a62497c1e436142fe28048a2b4d133905814a1808bc5b3e45eaa9eaebd946bee806968aeeb5a9eed87eba3d25d0b412a1b4cf2d419a58b09fc275c4395a0bd332eb538321465043e5967dd22459d0f52190a37f93ab823431a81fa6f54de61637fd473e19a6f567fead100e7d8cac149b66ebe9973af846146c62065a64854ed21e8b6f6fbe78474b753915a42efcb7da8ad18bacff8d69e0af1ca1f8174530a21820738412b100b54ee9b4a0dc22d5fe1cadecaea73fbfad087b19ce53177488d230539c5174f572a539d9d7c42698aa82bccf030ad393f25c10baa17e919f647d0e31877b7a6c1d8d86583f884a0c1da07b9b6dced06cdeb0094aa635a82f233b5993926b8970a0840ba116a7d20a40efb3bd03c4bdf380a2510a0a1ea69811ded68943c71218b42783b38959753978f222e1396b9b36dee2ce205122a000577cab29f48bff4f88c417e6bf5fb430d925596f29aca8677ca5a113aeaa5e0252ca17244d6c76e78ff1bbd81a71c4dfc72431d7f1126f8bdbf4056ee0f58a1bf83d53b1de07489541182dc4ee0f573c25b6c15dad930bc7a770b5a4f407d7a879db7185f15f80100000000000000739cc97db66ec6b925955d9a591808947fdd8d484ad27353230a449fdf87fc46c73b852fec931cfb6718acf3315bf5e577d00beb77c5514bc05d576a81345a03ad7aae74c5d2b77d45718348aed4fcbcd1441ff31b8f038824a989a9446a4a69367b228b3d174230b7320fc4d3c03368db573816dd0c04e65d6f8ce48283e76abdddbb965e0b2568e93c9cc5494a55421793f562c50c53f876cbde93c5cc7a3099c99d9775af010ba093f8a13b771782a3cfb24fbde6ef763e20c613164ab014d1906c4e098f1431b6b2886a155c4bac2911d7ee6a646f5913205ebd175e68975b93c330e4f9131788026b3b7cd5b6452c9e17452ac70000000000000000000000c71185f72436640fd4294fc3da230f9065095be47d7a848df12316c3c8b184fe110b061987fd79cf7d83443e69d08e2e839ae4fbe26ef7764f4870ef3bd0ec12eb45f60ca10dbfe329271f0bc93b28798e982e0dd32fc14bd4313c63b2dbb568f33fb45acad2dc7f438ea162c0709c0bbe1ea13e1e47399286e8143f400d7adf5f69e455706626814ee49274667f47769293451fd49885a152b8d2cf18febc7993f4a93893c6c7b7e46a230359ef2443e6bb9f50bb0faa5eaafd3ed6d551600c46b58a29fd7ccbbb0616f0be27302b683eccd742791d97f4a1daa0447f004426fd09b67d926f51525da63987bc73af35b28277879089b89fff6edab2fa1caf660a46a1a9f09e2d095b1c4be95c7c33dc81857f580e36c0a78d94dd879ee18de4a6475858d2ded2e3427ae007cc6f8e5e99aa146667f71ad83f3ddcf5db2dc396d7da499b65cd98125f20c284fc84d6a70be1de44b49c82022225292199c75cc26beab98dce4c331ed722f01d0d6314a72416814a565f4d90a5f8a255810f23541082f4b06f451e4724cd882f4d589600000000005854ca490d7df9cc293547c9a51aecc7a92f417f6a4d327737f1b198252358832dbe43507844a0cc112af4ce457c173fa64174ffd5ab9501eeb85508ebb60e169c0736c5960f2fe08735d6a7aa7c1f4a6433e77d3e547bbe6cf5b5d93a491ab4bba1ea7a1e6f37618b1d74cff3630d85a210092211be1ec12a30891eef590b19cdde055d626818c64e1c56b8918f33441a64b54946571b7bc70fb065d3bb1647f6f989ab8159e6d1cfa6c0ec7329d7d2263ca22144bf17d8692f03b592bd0f610096094da096233984e95b9a8216a6e60a104ae0bb5f77ac70b4390ea2cb6f6c40c928fae489f447240a25fd0a5bd9d5b6cd2a98f8804862922c11229c4e45c765e4d3348af3d3aadd5cc24b39437f1ea2df0000000000000000000000000022b90d93a267f3af4e02606f0ce6c2ffc404b575a09d6e625f3248689005eb4a9c8df3c67e6b2b759cab3a7bedf1b927cd8ba6d13b3e7d7279515e3d6d20"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) executing program 2: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000600)={{0x1, 0x1, 0x18}, './file1\x00'}) r0 = open$dir(&(0x7f0000000640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x4800, 0x85) renameat2(0xffffffffffffff9c, &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0, &(0x7f0000000280)='./file0\x00', 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = syz_io_uring_setup(0x238, &(0x7f0000000380)={0x0, 0x80fd, 0x400, 0x3, 0x265}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffff4, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r1, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @loopback}}) io_uring_enter(r2, 0x3532, 0x32c9, 0x45, 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x50) r6 = fanotify_init(0x4, 0x1000) fanotify_mark(r6, 0x105, 0x5000003a, r5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1000, 0x0) r7 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) unlinkat(r7, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) io_setup(0x34, &(0x7f00000002c0)=0x0) r9 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x100002, 0x0) ioctl$IOCTL_START_ACCEL_DEV(r9, 0x40096102, 0x0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f00000021c0), 0x2, 0x0) io_submit(r8, 0x1, &(0x7f00000001c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x5, r10, &(0x7f00000000c0)="aecf", 0x2, 0x7fffffffffffffff}]) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, 0x0) r11 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r11, 0xc0287c02, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000540)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, 0x0, 0x0) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000258f88)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x96, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) msgsnd(0x0, &(0x7f00000003c0)={0x2}, 0x8, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x0, r8, r7, r8, 0x100, 0x9}, 0x0, 0x0, 0x5, 0x2, 0x6, 0x8, 0x8, 0x45b, 0x6, 0x4, r6, r6}) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r1) pread64(r1, &(0x7f0000000380)=""/81, 0x51, 0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$pptp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x17, 0x0, 0xff}, [@IFA_CACHEINFO={0x14, 0x6, {0x10, 0xfffffffd, 0x80, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) pread64(r1, &(0x7f0000000140)=""/108, 0x6c, 0x0) ioctl$TUNSETCARRIER(r0, 0x400454e2, 0x0) executing program 34: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r1) pread64(r1, &(0x7f0000000380)=""/81, 0x51, 0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$pptp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x17, 0x0, 0xff}, [@IFA_CACHEINFO={0x14, 0x6, {0x10, 0xfffffffd, 0x80, 0x10}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) pread64(r1, &(0x7f0000000140)=""/108, 0x6c, 0x0) ioctl$TUNSETCARRIER(r0, 0x400454e2, 0x0) executing program 6: r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x1, 0x2802) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000840)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000880)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x0, 0x0, 0xe, 0x0, 0x0, 0xfffffffe}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x400}, @TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40004}, 0x0) unshare(0x2a060400) r4 = socket(0x40000000015, 0x5, 0x0) bind$inet(r4, &(0x7f0000000280)={0x2, 0x0, @multicast1}, 0x10) pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000240)="c5", 0x1}], 0x1, 0x4009, 0x1000007) r5 = socket$rxrpc(0x21, 0x2, 0xa) rt_sigprocmask(0x0, 0x0, &(0x7f0000000040), 0x8) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r5, 0x110, 0x4, 0xffffffffffffffff, 0x0) executing program 6: r0 = socket(0x2b, 0x1, 0x1) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(r1, 0xe, &(0x7f0000000100)={0x8, 0x80000100008a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) syz_clone(0x801180, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x14, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xb0, r6, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0x64010100}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xa00}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@private=0xa010102}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20040001}, 0x40) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) setsockopt$IPT_SO_SET_REPLACE(r0, 0x60, 0x40, 0x0, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001040), r7) sendmsg$IEEE802154_ADD_IFACE(r7, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001080)={0x28, r8, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044000}, 0x20040000) executing program 6: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = msgget$private(0x0, 0x1) msgctl$IPC_STAT(r1, 0x2, &(0x7f00000000c0)=""/80) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r7, &(0x7f0000000240)={0xa, 0x4e22, 0x1007e, @loopback, 0x1}, 0x1c) bind$inet6(r6, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x34, 0x40, 0x107, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x6, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x80000001}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24048881}, 0xc000) listen(r5, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) executing program 6: r0 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0) write$binfmt_script(r0, &(0x7f0000006700)={'#! ', './file0', [{0x20, 'j\x1e=\x01!\x88\xdc\xc3u\x1d\xbcQ{\x8c\x8b\xe8&\xfa\xf1\xfe\x16u6\x1f\ty\x15\x8b\x89\xc1\xbb}(\x99o\xdb*\x8eI\xa3s\xb4\xc6\xb5\x10\xf9\xfa\x18}\xf8(\xb5\xf7\x8aSe'}, {0x20, '[k'}, {0x20, 'AR\x86l\xca\x8cF\xec\xad\xc5\x89\x10o-\xc5h\b\x90x'}]}, 0x5b) add_key$keyring(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0xa, 0x4) setsockopt$packet_int(r1, 0x107, 0x9, &(0x7f0000000000)=0xd938, 0x4) getpeername$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x14) executing program 6: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self\x00', 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r3, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0xa, r4}) dup3(r1, r2, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYRES8=r4, @ANYBLOB="2390665579bfddbcb633b19c5d8195847acde2738a21c174b7c935f37afbef65c7ee33b4e3827b71", @ANYBLOB="e51dff5e50a6a40560dbd4052bca"], 0x0}, 0x0) executing program 6: setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000000)=0xe, 0x4) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued\x00', 0x0, 0x0) close_range(0xffffffffffffffff, r0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000080)={0x80002000}) (async) open_by_handle_at(r0, &(0x7f00000000c0)=@isofs={0x14, 0x1, {0x800, 0x40, 0x3, 0xfffffffd, 0x642, 0x4}}, 0x2000) (async) ioctl$AUTOFS_IOC_FAIL(r0, 0x9361, 0x16f) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r0, 0x40309439, &(0x7f0000000140)={0x3, 0x1}) (async) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000180)={0x8, 0x8, 0x4, 0xc, 0x5, 0x0, [{0x1ff, 0x4, 0x8, '\x00', 0x8}, {0xfffffffffffffffb, 0x6, 0xfff, '\x00', 0x409}, {0x0, 0x6, 0x10, '\x00', 0xc05}, {0x6c, 0x7, 0x3, '\x00', 0x401}, {0x1, 0xfc3a, 0x3, '\x00', 0x400}]}) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = fanotify_init(0x10, 0x400) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f00000002c0)={'wg1\x00', 0x3a4}) (async) ioctl$BTRFS_IOC_QGROUP_CREATE(r2, 0x4010942a, &(0x7f0000000300)={0x1, 0x4}) (async) r3 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0xfbab8e0a08f84d87}) (async) syz_clone(0x40000000, &(0x7f0000000380)="cae5b9d0a75cedc1ba7ca1d00d692bf069ca438542af1665590bb5a91f1f9a77cf239070d603deb1a8cf3195f3b2a91606a9ca79d471d7966135c467ae9e9e8410af538f396d446636d4de4ccf7d1b7afcc395787d13f862fca8ac8d9e190071f43e052ce6fa544ae99fd5d043faac4fc3f7d07167d1e5764cb568861138fd27a0d5b088979f75f3b9fba6ab1604ac342a29351cfd18e56dec5f3a8acbbd850244816fcf4a453eb2f17be54b1fd1791762ed9f9de4c84f7a539886c7bf3bc7c545886131746e6e0c9fdd8ed00735eeb5e85fdf0b56ed00c1b48f4e194a525990adc641817427eb04de4a88381af320b540e40d64ebc246d777bb651bde7e96629ccb61bd6043b5738c20a9968f1d59aac76fb3de032fed5f0f3f8c4d5be7f4320ba7c805784815f2202e24eb3b43ac6e97e94f20d1cb41b1387e9202699bbb5209056575c54dcd73b6d85c30c96d458319fccace6b3a9e5b44e251fa5167a972f38625c6de4fc88a6ef76c1b0a7f9046afeab54459756a69cbc9b5a75b004506d8b096b4c2523878cdb662f0aa3400a1b1dcce885b2b1e2d326a58f4f5e04c80ae371079bd047d5018a7263d9f46e53608efcaea18d40ab362f707863a6da9b03da461fb72a28c37e4bc1e3c1aa8c31396bce6b977d75b958805f8f805100eb81b5ed8af04d9ff958de9241abba006948cd509d8937032c8d7eb82b782774ddd8cbc97793e49ec57262d2e2650d158aa4e80cfe753cff83c407534bbb551c4ffd040959533952498853a6d5b43d57d1900a341e32a1c4889ee8d7ce85fc6d9e104371242e40d9d8143f62899849aa8585c272beb8f0a5de6e2bb4fd2bf47371068d2cd712a59fc58d7e6b35e637c57123d370b6875f4b4219523a18b3aa5f65f693f5b8c4837271339fd5fa85a04174cb0a2296a2699e899ae911d118e49b81150056b08f59f91540111b62772105a484344af8e8cb6667af8c534c4569fb8da740d1bb1e46c1ff45238c84b80e6bd6ca70d15c9cd5719d8ec4c432f7517cf63e847447d59eccb15902fb10ffdb24539e1507bd6c7e946ecf4c773f0d740a34a15fba4531ed2222444bc37a188fb8eb0ca2b5a7b418ec43fefadf4ee6218969d32b0b24455c1dc971acf453bf1a406ad5fb04ceb833356d828d454b7ad9d662ae04125b50b152027d476c696dc7f7b19c6129bfd042ae4143ca91106181bfd4524bde48b2f457eea068b51def018f2ff7f1cb0d1a018b80c9864330e4658af63ba063c83b08be6d450b90eddcfe7138d49b85f2d588ae85f92cbffc843165720511618efb8f30d9f710bc2e77fd4ccd20d1bd3d74294fbd637520b088e1c834ecf690a8ddd5540d57265e03f44e6e567c52a5274264fd6eabd07df234bc6ed951d3dc2d81b05d0e68f4e3dee6375b98140b7d09fa97719fe7fe823a7ef4932f370f2ca38da453a5f931b051336bd77ab39e0e6bc272985851c4c42710f32abcc542c27cc1ecec5a9fc0eea0f96252b2d591969291cb157649d13c74a4cff5c220c376050c483c9e3c14cee0f58b331f2ffea1ab9253edef812562e480e2a5d07d65d8bda46f0820b426bcf62d771c54bc5f4a5385b2882bf5f3a470730b418c24014b1e366c4b13e4606bf76e4c372af07fbea66a0f914d462cca26ea3a8c818c45bfa433af50b2c55ba658463ec6eb3477d02a8fa16d9ef5ac1de822fb6e435a4db8dfe303fecd3bceab16f84e62fc185dbd180829277d6f913f01be43a464fa720b69aac4d620fe71caf392863129e3847a8e872049f7f78ad5fcc371c870a87acbfc53f3bcc1b0f351096b84a927637208156ef41c03325c8e05bb3ef97ebb95591ca29461dd7bde497c358cc9f53d96af5f52438a7b1f53f3d5f26668914759e97c315e7c6e7934f23c4fc91393e73870e283a0b6fbdab353dc550fbfe47eea43d398b486222b549f8b7449dda283330d9cd680b3071b8365a317a6e0ef8fc7739fafa37bf9c8ea47638ab376177738dff3517bd9dd9129abd6c134bee52f12db1f57cc020e94b28637eed1ec28e2a5f58ff6e1e0948d567c17e9f603193712c0832ed7800e07bac9fce9b21b6645155ac2d16e94b8537f0f9f7c73449e9c7c15f820b6867c79008f1c002f8c88f07064d0e2495adf5dbe7e5f3507f8364b4513661dc7fa4118a3b95dfa004ee94255a83025a3a11036e1b3d9fb23b9862df42ae5eac2f1732980607244198565c150bcab81a0031dadf9d08e38a4662bd919c4211fbf41f3700332da1d4e0e8c9cb453e403b2fe545d0b7f6120e2f85aa313dc0e96d756b03d8b0487382c7a73727d461656210cd7e6ff8bb08eaf0692f555bfdf79b2db42c7fa346f157a69b681165a055ac519c5cb056eec33808596dafd3ddc4b8e0a15e2601aa1620453eee3c0ce6d7345ab9333f797071a94b2698ecb5399feff0294cb3a4c999ef65acf6871665635a6f385f1bc2b3cf83b4e4f679033912f2c728918bf667debb39e350e5b128ff7b203dc99432769469cb108ceb024a87032fc102b0416b48e0be33cbe2b6f93178b56efed268bdc596853a936fb259b441460dceee1f8bc286e1fd1d3db0c331f1230610468921ec5e87e8fd7dcca676057c0f18f78fd730469de49a043a84b4159a7398e460ff65be5cea6f758a0a7d7c074bf57be14eae5ca1a5bdcbb294af2b2da890ccb80cfb631ab3618db89f8bac7fe88a6306bc14d48944439a4a50213043deaa6bbd026c58e1ba1007a929b63d73392facd31beb547246cdf5befb18d0289e4d9463c6fb121e8c2c937a45711f977d6f7d3831b50e83745ac9c582a2aa2062e2830ed64407fe5da86ec0115f9b190cc60492fb5e07e52b5884793850cf8fa13b2c49637b2aaa8cd57d96a7a5c09c0989f1f7b164b32b5a3aec4401b9a60d77976a71bf0ba91152a5f8eae8e6aa7996eaab713759e74ce98ce81be06f9d8dcc44bfe71753f6cfcbc4df9c32cf9a58ea9618374a24e42717f004cbdbca0cb372ebffdc8227b0ca0199eb3b9c6133b9abfed37a3f9f6aacf110caf98d64b88e0aba11b88000eaf5038400791040de42604197d3dd4d94b977c96d5770b98bdd5ac7286bea465a3647d5dfdc5b4c164f7adfdd995fd74c40ab865645ea64e622b909e7a2e6291ada1c770bb5a7698e3b2b77fddcd749c2ba56b300f4e0a781ec16ed6739401ba578b3c9b5c6bd1ecf5f4ce285c9ff2eeaa3666f0e0e15beb03776bc1cf25534666153db2c613df13171eec83cd75f84c06899c9e1646ddc0079cf490362685aafdac446f026e4f1a9cf592b3c330aaf705608d9bc5d4e4256e2d8b1ad5e41ba0dcb436290212ed337c61e573b26c6d38dda20b076089baef0d7217ec98ecbb3f0f4b403f24e53defacdb5222d6b2563e5e495e34fe56c1417a2b87d66913fd525a43f60c323adceabc55cf8d99c7a06e1e7124135c4ab0263e452a6cab9bf3cd57cb7f49513ce76369bf55256ff9c30e33ed14b10649171e68ae75f3fdcff1d3337b0211160c3666b311834ea355043cbbf97e7299f64d29736ccf72f0ad83a64761ce36ca0808c276a7779f4244d15a5eabb4d1306e8ed61ae09b8a08735570fa5b46e1837c45231ea66229037deaaa6ad2e489a287a0e19cfbe822c03d272a34d942c4426d58d737ee94d82341777de23348d0b73c88f110cb1dc39127812adceff769acdbce95c62a8dd43a9bd48a03924c7dbc972fe63d9014ba09ea1f07d19af9e471ead5b4afa6013757bf27fdf4a2fa048f407f9ec72652093ec76ce7437898dce38cb168dad8d63ef9dea26210f31287ca4934b5b770a1ce0f1f071d6acacf2dd6793455a4e7b6bdd14dda463ed6cbcc070deda29a887f52ed9264dfae5d7bd86acc5c52b9188bad97e7c69ca24477a1a9ec57cf475eb2aec6b363a38cf4498613ae04315f77863cb0d586cf4db3f893bdc590b6982319fe5de6aa74becbf9b2a6f52fe3cdb8de652ff5e8297ba2b0ab4029caa75eaf34ec47661f884c22539fd419108494546bc5f034c952cf901952024ce577a896b5086c24fbdef91edea54c99298ee5eee36a5394063b6143d0d85b08b6d20d31fc4cf98dd24a9f315502919baa36f51a13d220022625816e39003b5fbadd51a446375ded5a259a49020c72ce6b1c8469da1549e9be7257d1145eb1c7b22f8665e3ac13158f8f26571c149ab77cb117acf4542a7c47d4bf75d23fa7915831d7ccd44f9a9c8ce9817f15f0b134fd8a8dfcbb460543c0c3190c927a2f3c1dc68e30fef4c1953a10d0a850b9ec86d7142516ec5c7677218224a10795c0c3c4428679d421c8b492de9acd0d49d095390a65fd4889f810f4ee61d37d000bce03989233accc3511d91ba48db3c6b786807dc8e1ede8415b92cb81caa4fd96114293f163d76c6373eb10b48dd6d35a0b1f6c1f2035f75d3d7f4a7abdf00f13cb6f346f7168fbddb904f096a8256454a03bd5787f5affcae4384d1d83caf78a427d4732dd4cd40f572c5afed4327b7d8426e2cbe67c6988d56b4c68e319c9390bbf7be7a23d7b3ccb049b524f4ab13a806d884a043a2e37f79f931172d4d8abbaadaa413c66fe4e4974296fa96a442a7d4607e7e8f43bfec28a818c8b83954120c3c4a0dff5ea1d722b143bb1e98606e094f8af546fe8d374075b03e3202af3113c8e94c6d4eb7b7d948c5ce3dede0ef519792a3d37a57fa2fac1b566890457be47c392d550361c5ce0a34bddbbe7dc5810bca12de144b3fbae7b601c2f6db31f45d7dc7b90b4aba50f2fbfcb40b89baa42a21b77908841ea4338c4ad218498fac1a78f392e83edf7a23e06746096f433bf3cfd4de688f1c5e280a34753659e1f478a74bd6ba265da6c747f61239f10aac7119baea33d18d8a9fbfb082644c8630bcf8970fed88e74a4546b37885652628aa56acb0c911f430675df2327a5b9f1626aba465133bc1a323ec46675667455f1a2c4650e96f0746f0597a8b99593d55aa7ac2e20521958f824ca9e980653ac4d582e8ae53fd3cbe482f550109b4db9002b5e930082fe62f33db22ff7cad26fc2543b892b0f57b34244022f23766f6736f1460e8cd2420c8c8c40db573a394548c5b04e2b5579dd1009afde57db23ea2eaefda012a2d9fe1c7f23b0c60be48a336aeeb8d8073bcd2723d0b751018c6fecd92bffa9694cd4c8de05d1f6f229c20537a4c7b31694d2e6040183746c5507cc4160aa1a1b9acae1970e671e1aec2e9d107c52a5ad0e08a5fe3f145eb9b0633ec875731b06b0f3f96e89c1db805fd7cf2aefbf785c15fdbf2f125b369c21c196fa16c3c6ea5a24439d1df4977c45e5c6dada15462c17e4574fc28f6dffa8f19d248011391dee2cdf6dd9ca143729cab8169e2887a92774955107e457d102132824fa6c06220ae86736c230014b2bbb315a3f98b1388a9df604a08708a385801a1380a2877948dbecb1fd6c734df3b56f1eda3a3a7b94cc8e1917c460986b0d09f995b63838d7a4f15bcb89545ecbc8e2de036d88f616e159206243dbc92d2118c831b3a44384c0597417af956006a5e9170653a5190c37968e349ed65eb06195981cf4fdcf63857621e1cd7b50c475c47d7f51eede07394641b33dc4d12a31f6699c1d1741420d2865b98fdcfa5403055a30160b5ce0f43cbe1bab56748b118f4e540e435643c83bc59372f23adfd0fe9447fd5cb8a04cb4f6e4716a259b8d703b9845c7abf68458c6b0e62e7eaa700338d3234e51f69818ca66000edcaa358a31979cf1061ddbd90088804ab", 0x1000, &(0x7f0000001380), &(0x7f00000013c0), &(0x7f0000001400)="ff6fd1575015e3669e9d5cb4c8e15fb9080dc6d42bcdcba7b15fd7cf97722de789f3987edb7e1845ab70217134e6d1") (async) r4 = socket(0x2b, 0x2, 0x6) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r4, &(0x7f0000001540)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x10008000}, 0xc, &(0x7f0000001500)={&(0x7f0000001480)={0x68, 0x2, 0x8, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x81}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000001580)={0x8, [0x4, 0x1, 0x81, 0x401, 0x7, 0x7ff, 0xffff, 0xfffb]}, &(0x7f00000015c0)=0x14) (async, rerun: 64) getsockopt$IP_SET_OP_VERSION(r4, 0x1, 0x53, &(0x7f0000001600), &(0x7f0000001640)=0x8) (rerun: 64) ioctl$FIBMAP(r2, 0x1, &(0x7f0000001680)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f00000016c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000001700)={0xeeefc000, 0x16000, 0x1}) (async, rerun: 64) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) (rerun: 64) ioctl$BLKREPORTZONE(r5, 0xc0101282, &(0x7f0000001780)={0x7fffffff, 0x1, 0x0, [{0x6, 0x8, 0x3, 0x17, 0x5, 0xfd, 0x2, '\x00', 0x1}]}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000001840)={0x1, 0x0, &(0x7f0000001800)=[0x0]}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000001880)={0x0, r6, 0xa, 0x8, 0x1}) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000018c0)=0xc, 0x4) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000001a00)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x20, r7, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4041) executing program 35: setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000000)=0xe, 0x4) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_queued\x00', 0x0, 0x0) close_range(0xffffffffffffffff, r0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000080)={0x80002000}) (async) open_by_handle_at(r0, &(0x7f00000000c0)=@isofs={0x14, 0x1, {0x800, 0x40, 0x3, 0xfffffffd, 0x642, 0x4}}, 0x2000) (async) ioctl$AUTOFS_IOC_FAIL(r0, 0x9361, 0x16f) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r0, 0x40309439, &(0x7f0000000140)={0x3, 0x1}) (async) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000180)={0x8, 0x8, 0x4, 0xc, 0x5, 0x0, [{0x1ff, 0x4, 0x8, '\x00', 0x8}, {0xfffffffffffffffb, 0x6, 0xfff, '\x00', 0x409}, {0x0, 0x6, 0x10, '\x00', 0xc05}, {0x6c, 0x7, 0x3, '\x00', 0x401}, {0x1, 0xfc3a, 0x3, '\x00', 0x400}]}) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = fanotify_init(0x10, 0x400) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f00000002c0)={'wg1\x00', 0x3a4}) (async) ioctl$BTRFS_IOC_QGROUP_CREATE(r2, 0x4010942a, &(0x7f0000000300)={0x1, 0x4}) (async) r3 = ioctl$USERFAULTFD_IOC_NEW(r1, 0xaa00) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0xfbab8e0a08f84d87}) (async) syz_clone(0x40000000, &(0x7f0000000380)="cae5b9d0a75cedc1ba7ca1d00d692bf069ca438542af1665590bb5a91f1f9a77cf239070d603deb1a8cf3195f3b2a91606a9ca79d471d7966135c467ae9e9e8410af538f396d446636d4de4ccf7d1b7afcc395787d13f862fca8ac8d9e190071f43e052ce6fa544ae99fd5d043faac4fc3f7d07167d1e5764cb568861138fd27a0d5b088979f75f3b9fba6ab1604ac342a29351cfd18e56dec5f3a8acbbd850244816fcf4a453eb2f17be54b1fd1791762ed9f9de4c84f7a539886c7bf3bc7c545886131746e6e0c9fdd8ed00735eeb5e85fdf0b56ed00c1b48f4e194a525990adc641817427eb04de4a88381af320b540e40d64ebc246d777bb651bde7e96629ccb61bd6043b5738c20a9968f1d59aac76fb3de032fed5f0f3f8c4d5be7f4320ba7c805784815f2202e24eb3b43ac6e97e94f20d1cb41b1387e9202699bbb5209056575c54dcd73b6d85c30c96d458319fccace6b3a9e5b44e251fa5167a972f38625c6de4fc88a6ef76c1b0a7f9046afeab54459756a69cbc9b5a75b004506d8b096b4c2523878cdb662f0aa3400a1b1dcce885b2b1e2d326a58f4f5e04c80ae371079bd047d5018a7263d9f46e53608efcaea18d40ab362f707863a6da9b03da461fb72a28c37e4bc1e3c1aa8c31396bce6b977d75b958805f8f805100eb81b5ed8af04d9ff958de9241abba006948cd509d8937032c8d7eb82b782774ddd8cbc97793e49ec57262d2e2650d158aa4e80cfe753cff83c407534bbb551c4ffd040959533952498853a6d5b43d57d1900a341e32a1c4889ee8d7ce85fc6d9e104371242e40d9d8143f62899849aa8585c272beb8f0a5de6e2bb4fd2bf47371068d2cd712a59fc58d7e6b35e637c57123d370b6875f4b4219523a18b3aa5f65f693f5b8c4837271339fd5fa85a04174cb0a2296a2699e899ae911d118e49b81150056b08f59f91540111b62772105a484344af8e8cb6667af8c534c4569fb8da740d1bb1e46c1ff45238c84b80e6bd6ca70d15c9cd5719d8ec4c432f7517cf63e847447d59eccb15902fb10ffdb24539e1507bd6c7e946ecf4c773f0d740a34a15fba4531ed2222444bc37a188fb8eb0ca2b5a7b418ec43fefadf4ee6218969d32b0b24455c1dc971acf453bf1a406ad5fb04ceb833356d828d454b7ad9d662ae04125b50b152027d476c696dc7f7b19c6129bfd042ae4143ca91106181bfd4524bde48b2f457eea068b51def018f2ff7f1cb0d1a018b80c9864330e4658af63ba063c83b08be6d450b90eddcfe7138d49b85f2d588ae85f92cbffc843165720511618efb8f30d9f710bc2e77fd4ccd20d1bd3d74294fbd637520b088e1c834ecf690a8ddd5540d57265e03f44e6e567c52a5274264fd6eabd07df234bc6ed951d3dc2d81b05d0e68f4e3dee6375b98140b7d09fa97719fe7fe823a7ef4932f370f2ca38da453a5f931b051336bd77ab39e0e6bc272985851c4c42710f32abcc542c27cc1ecec5a9fc0eea0f96252b2d591969291cb157649d13c74a4cff5c220c376050c483c9e3c14cee0f58b331f2ffea1ab9253edef812562e480e2a5d07d65d8bda46f0820b426bcf62d771c54bc5f4a5385b2882bf5f3a470730b418c24014b1e366c4b13e4606bf76e4c372af07fbea66a0f914d462cca26ea3a8c818c45bfa433af50b2c55ba658463ec6eb3477d02a8fa16d9ef5ac1de822fb6e435a4db8dfe303fecd3bceab16f84e62fc185dbd180829277d6f913f01be43a464fa720b69aac4d620fe71caf392863129e3847a8e872049f7f78ad5fcc371c870a87acbfc53f3bcc1b0f351096b84a927637208156ef41c03325c8e05bb3ef97ebb95591ca29461dd7bde497c358cc9f53d96af5f52438a7b1f53f3d5f26668914759e97c315e7c6e7934f23c4fc91393e73870e283a0b6fbdab353dc550fbfe47eea43d398b486222b549f8b7449dda283330d9cd680b3071b8365a317a6e0ef8fc7739fafa37bf9c8ea47638ab376177738dff3517bd9dd9129abd6c134bee52f12db1f57cc020e94b28637eed1ec28e2a5f58ff6e1e0948d567c17e9f603193712c0832ed7800e07bac9fce9b21b6645155ac2d16e94b8537f0f9f7c73449e9c7c15f820b6867c79008f1c002f8c88f07064d0e2495adf5dbe7e5f3507f8364b4513661dc7fa4118a3b95dfa004ee94255a83025a3a11036e1b3d9fb23b9862df42ae5eac2f1732980607244198565c150bcab81a0031dadf9d08e38a4662bd919c4211fbf41f3700332da1d4e0e8c9cb453e403b2fe545d0b7f6120e2f85aa313dc0e96d756b03d8b0487382c7a73727d461656210cd7e6ff8bb08eaf0692f555bfdf79b2db42c7fa346f157a69b681165a055ac519c5cb056eec33808596dafd3ddc4b8e0a15e2601aa1620453eee3c0ce6d7345ab9333f797071a94b2698ecb5399feff0294cb3a4c999ef65acf6871665635a6f385f1bc2b3cf83b4e4f679033912f2c728918bf667debb39e350e5b128ff7b203dc99432769469cb108ceb024a87032fc102b0416b48e0be33cbe2b6f93178b56efed268bdc596853a936fb259b441460dceee1f8bc286e1fd1d3db0c331f1230610468921ec5e87e8fd7dcca676057c0f18f78fd730469de49a043a84b4159a7398e460ff65be5cea6f758a0a7d7c074bf57be14eae5ca1a5bdcbb294af2b2da890ccb80cfb631ab3618db89f8bac7fe88a6306bc14d48944439a4a50213043deaa6bbd026c58e1ba1007a929b63d73392facd31beb547246cdf5befb18d0289e4d9463c6fb121e8c2c937a45711f977d6f7d3831b50e83745ac9c582a2aa2062e2830ed64407fe5da86ec0115f9b190cc60492fb5e07e52b5884793850cf8fa13b2c49637b2aaa8cd57d96a7a5c09c0989f1f7b164b32b5a3aec4401b9a60d77976a71bf0ba91152a5f8eae8e6aa7996eaab713759e74ce98ce81be06f9d8dcc44bfe71753f6cfcbc4df9c32cf9a58ea9618374a24e42717f004cbdbca0cb372ebffdc8227b0ca0199eb3b9c6133b9abfed37a3f9f6aacf110caf98d64b88e0aba11b88000eaf5038400791040de42604197d3dd4d94b977c96d5770b98bdd5ac7286bea465a3647d5dfdc5b4c164f7adfdd995fd74c40ab865645ea64e622b909e7a2e6291ada1c770bb5a7698e3b2b77fddcd749c2ba56b300f4e0a781ec16ed6739401ba578b3c9b5c6bd1ecf5f4ce285c9ff2eeaa3666f0e0e15beb03776bc1cf25534666153db2c613df13171eec83cd75f84c06899c9e1646ddc0079cf490362685aafdac446f026e4f1a9cf592b3c330aaf705608d9bc5d4e4256e2d8b1ad5e41ba0dcb436290212ed337c61e573b26c6d38dda20b076089baef0d7217ec98ecbb3f0f4b403f24e53defacdb5222d6b2563e5e495e34fe56c1417a2b87d66913fd525a43f60c323adceabc55cf8d99c7a06e1e7124135c4ab0263e452a6cab9bf3cd57cb7f49513ce76369bf55256ff9c30e33ed14b10649171e68ae75f3fdcff1d3337b0211160c3666b311834ea355043cbbf97e7299f64d29736ccf72f0ad83a64761ce36ca0808c276a7779f4244d15a5eabb4d1306e8ed61ae09b8a08735570fa5b46e1837c45231ea66229037deaaa6ad2e489a287a0e19cfbe822c03d272a34d942c4426d58d737ee94d82341777de23348d0b73c88f110cb1dc39127812adceff769acdbce95c62a8dd43a9bd48a03924c7dbc972fe63d9014ba09ea1f07d19af9e471ead5b4afa6013757bf27fdf4a2fa048f407f9ec72652093ec76ce7437898dce38cb168dad8d63ef9dea26210f31287ca4934b5b770a1ce0f1f071d6acacf2dd6793455a4e7b6bdd14dda463ed6cbcc070deda29a887f52ed9264dfae5d7bd86acc5c52b9188bad97e7c69ca24477a1a9ec57cf475eb2aec6b363a38cf4498613ae04315f77863cb0d586cf4db3f893bdc590b6982319fe5de6aa74becbf9b2a6f52fe3cdb8de652ff5e8297ba2b0ab4029caa75eaf34ec47661f884c22539fd419108494546bc5f034c952cf901952024ce577a896b5086c24fbdef91edea54c99298ee5eee36a5394063b6143d0d85b08b6d20d31fc4cf98dd24a9f315502919baa36f51a13d220022625816e39003b5fbadd51a446375ded5a259a49020c72ce6b1c8469da1549e9be7257d1145eb1c7b22f8665e3ac13158f8f26571c149ab77cb117acf4542a7c47d4bf75d23fa7915831d7ccd44f9a9c8ce9817f15f0b134fd8a8dfcbb460543c0c3190c927a2f3c1dc68e30fef4c1953a10d0a850b9ec86d7142516ec5c7677218224a10795c0c3c4428679d421c8b492de9acd0d49d095390a65fd4889f810f4ee61d37d000bce03989233accc3511d91ba48db3c6b786807dc8e1ede8415b92cb81caa4fd96114293f163d76c6373eb10b48dd6d35a0b1f6c1f2035f75d3d7f4a7abdf00f13cb6f346f7168fbddb904f096a8256454a03bd5787f5affcae4384d1d83caf78a427d4732dd4cd40f572c5afed4327b7d8426e2cbe67c6988d56b4c68e319c9390bbf7be7a23d7b3ccb049b524f4ab13a806d884a043a2e37f79f931172d4d8abbaadaa413c66fe4e4974296fa96a442a7d4607e7e8f43bfec28a818c8b83954120c3c4a0dff5ea1d722b143bb1e98606e094f8af546fe8d374075b03e3202af3113c8e94c6d4eb7b7d948c5ce3dede0ef519792a3d37a57fa2fac1b566890457be47c392d550361c5ce0a34bddbbe7dc5810bca12de144b3fbae7b601c2f6db31f45d7dc7b90b4aba50f2fbfcb40b89baa42a21b77908841ea4338c4ad218498fac1a78f392e83edf7a23e06746096f433bf3cfd4de688f1c5e280a34753659e1f478a74bd6ba265da6c747f61239f10aac7119baea33d18d8a9fbfb082644c8630bcf8970fed88e74a4546b37885652628aa56acb0c911f430675df2327a5b9f1626aba465133bc1a323ec46675667455f1a2c4650e96f0746f0597a8b99593d55aa7ac2e20521958f824ca9e980653ac4d582e8ae53fd3cbe482f550109b4db9002b5e930082fe62f33db22ff7cad26fc2543b892b0f57b34244022f23766f6736f1460e8cd2420c8c8c40db573a394548c5b04e2b5579dd1009afde57db23ea2eaefda012a2d9fe1c7f23b0c60be48a336aeeb8d8073bcd2723d0b751018c6fecd92bffa9694cd4c8de05d1f6f229c20537a4c7b31694d2e6040183746c5507cc4160aa1a1b9acae1970e671e1aec2e9d107c52a5ad0e08a5fe3f145eb9b0633ec875731b06b0f3f96e89c1db805fd7cf2aefbf785c15fdbf2f125b369c21c196fa16c3c6ea5a24439d1df4977c45e5c6dada15462c17e4574fc28f6dffa8f19d248011391dee2cdf6dd9ca143729cab8169e2887a92774955107e457d102132824fa6c06220ae86736c230014b2bbb315a3f98b1388a9df604a08708a385801a1380a2877948dbecb1fd6c734df3b56f1eda3a3a7b94cc8e1917c460986b0d09f995b63838d7a4f15bcb89545ecbc8e2de036d88f616e159206243dbc92d2118c831b3a44384c0597417af956006a5e9170653a5190c37968e349ed65eb06195981cf4fdcf63857621e1cd7b50c475c47d7f51eede07394641b33dc4d12a31f6699c1d1741420d2865b98fdcfa5403055a30160b5ce0f43cbe1bab56748b118f4e540e435643c83bc59372f23adfd0fe9447fd5cb8a04cb4f6e4716a259b8d703b9845c7abf68458c6b0e62e7eaa700338d3234e51f69818ca66000edcaa358a31979cf1061ddbd90088804ab", 0x1000, &(0x7f0000001380), &(0x7f00000013c0), &(0x7f0000001400)="ff6fd1575015e3669e9d5cb4c8e15fb9080dc6d42bcdcba7b15fd7cf97722de789f3987edb7e1845ab70217134e6d1") (async) r4 = socket(0x2b, 0x2, 0x6) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r4, &(0x7f0000001540)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x10008000}, 0xc, &(0x7f0000001500)={&(0x7f0000001480)={0x68, 0x2, 0x8, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x81}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000001580)={0x8, [0x4, 0x1, 0x81, 0x401, 0x7, 0x7ff, 0xffff, 0xfffb]}, &(0x7f00000015c0)=0x14) (async, rerun: 64) getsockopt$IP_SET_OP_VERSION(r4, 0x1, 0x53, &(0x7f0000001600), &(0x7f0000001640)=0x8) (rerun: 64) ioctl$FIBMAP(r2, 0x1, &(0x7f0000001680)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f00000016c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000001700)={0xeeefc000, 0x16000, 0x1}) (async, rerun: 64) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) (rerun: 64) ioctl$BLKREPORTZONE(r5, 0xc0101282, &(0x7f0000001780)={0x7fffffff, 0x1, 0x0, [{0x6, 0x8, 0x3, 0x17, 0x5, 0xfd, 0x2, '\x00', 0x1}]}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000001840)={0x1, 0x0, &(0x7f0000001800)=[0x0]}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000001880)={0x0, r6, 0xa, 0x8, 0x1}) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000018c0)=0xc, 0x4) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000001a00)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x20, r7, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4041) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r0, 0x400454c9, 0xba98575a95aeb70d) socket$inet_mptcp(0x2, 0x1, 0x106) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000019c0)={0x0}}, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x57) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0xa, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100000100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc39, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x101, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x4, 0x5, 0x8, 0x80008000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x7fffffff, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0xfffffffffffffffd, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x3, 0x6, 0x5, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0x3, 0x7]}) r3 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x1d}}, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 3: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_capability(r0, &(0x7f00000001c0), &(0x7f00000002c0)=@v3={0x3000000, [{0xfffffffc}, {0x8bcd, 0x7}], r1}, 0x18, 0x2) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x30842, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000140)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], 0x4, r3}) ioctl$RNDCLEARPOOL(r0, 0x5206, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) (async) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e001"], 0x190) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000080)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, 0x0, 0x4008090) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) (async) io_setup(0x8f0, 0x0) r3 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201080000000020ef0ec47200000000000109022d000100006002"], 0x0) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) (async) syz_usb_disconnect(r3) (async) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB='+cpu +devices -perf_event :net \x00cpu '], 0x24) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) (async) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) bind$can_j1939(r7, &(0x7f0000000100)={0x1d, r8, 0x0, {}, 0xfd}, 0x18) connect$can_j1939(r7, &(0x7f0000000080)={0x1d, r8, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) sendmsg$can_j1939(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r6, {0xfff3, 0xffee}, {0xa, 0x9}, {0x2, 0x4}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x48040}, 0x20000050) (async) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000140)=ANY=[@ANYBLOB="00000200bbbb03bbbbbbaaaaaaaaaabb"]) executing program 3: r0 = syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x40, 0x48c0) ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x4d2b, 0x400, {0x0}, {0xffffffffffffffff}, 0xaf, 0x7}) (rerun: 64) sendmsg$nl_generic(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f00000000c0)={0x394, 0x31, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@generic="383938fcc3a3c0a1ea269e3a6e4871280ad49b6ae855c944181df23d4b077b82ee9355491ac7", @typed={0x4, 0x49}, @generic="91ddcd12503e2a17ee2c2de112c99ea0bf760d933abf1654fce5faba2bddecb71dc6a737cafdbf964bf031fbec1d2d134b32470cd5d194b37adef8b3c546c36d21022481b345c21906503dba77c32d10265773793348e36ec92ddd406074578308c76372c6d8652dad6b47baa7c3654325ac80edb5962b30a705288ab8b8029ed3a4c68714e0ba11fe5cd47a71c62e5bd12992f87d74d66ffc8b27a40d9bcabef406ec1482cf5988331fad9146a8a90cc50740d54eb93558d66c0bef6185b2c1b2bc3dbd90b4b060e55501509dc95418ebeb5e32980e1821cb6442676114413e54ea99e49df5932c6260c3895f1e", @nested={0x24c, 0x34, 0x0, 0x1, [@generic="467ce663543eb7fd740eabe13a08ad8aa91f9222afc1967f43ceaa6890ee37fef4e5035819604476", @generic="db6b3d92a2eda53fb361fb625df258dc9b56ef839dcc954761908e9ece3445b68c8610eaba24fda328d3bcb6353a5c9fffd79dec69ad0d25364b037a15f1f7a7414e4645c56271699d257dc581cc1ed2dc6c465937502929af6a830d0d031c8bb3179f88356b6c5de02148048a2b2b648203a20ac2ba6621a3febe4b8912f7a2e9669d003a08bc41d61263d7feef7ce111d0", @nested={0x4, 0x112}, @generic="3c2bc439d153990e44d3000b22278708aefc890f34a692ca6faac2ee3080348793d108f55f31cfc14ae41b2157a64be3558961e4512a6c1769d6d040e48ad375b7ee277b668cc5dd51d6801461955b97dc1c9625bc4a2622ea48822f2e6a538fc92770fbb788c4fa0387e2b1e630030476122d0cd6fb08f77a19549b3e5f581d4483d8e7e65dbe53cca48f26a881ff0eb3f26049238501adc24d94034dadde2aef8b18968f20eed5ecc2f12284316757a2432bc01d9d468add9b8c2903e9cf9c029249684c1647dd7dce40540ff15d47ca19672e1f32a3a38f6906aeaddea9451da95bff74dde4d00ee4a3fc8c2bebccd5662e17491db52e96", @nested={0x4, 0x128}, @generic="25f640f17d303bfe29e430ecc4890c9cac1778c69336074219ad595d89a56cc12641d355e7aef40af68f5c309a6dcc9a7f3eea0836da76a56b89a90e7698d316232edd1115334308cd8e5a326ac811789f0493bed2f14a0cf7c27298755a137b3bd633e062c6786cb0958bb262199c053857717b9583269630d973f195351a5f0f41a2faba", @typed={0x8, 0x28, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @typed={0xc, 0x55, 0x0, 0x0, @u64=0x3}, @typed={0x8, 0x35, 0x0, 0x0, @pid=r2}, @typed={0x8, 0x51, 0x0, 0x0, @u32=0x1}]}, 0x394}, 0x1, 0x0, 0x0, 0x900}, 0x8000) (async) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000500)={0xfffffffb, 0x2, 0x4, 0x0, 0x9}) ioctl$XFS_IOC_FSGETXATTRA(r1, 0x801c582d, &(0x7f0000000540)) r3 = syz_socket_connect_nvme_tcp() ioctl$EXT4_IOC_CHECKPOINT(r3, 0x4004662b, &(0x7f0000000580)) (async) readv(r3, &(0x7f0000000780)=[{&(0x7f00000005c0)=""/48, 0x30}, {&(0x7f0000000600)=""/150, 0x96}, {&(0x7f00000006c0)=""/170, 0xaa}], 0x3) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000ac0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000a80)={&(0x7f0000000800)={0x260, 0x0, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x58, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2b}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x37}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xff}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x30000000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x80}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb6}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}]}, @TIPC_NLA_SOCK={0xa8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xf356}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10001}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xb}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_BEARER={0xa0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0xc47, @rand_addr=' \x01\x00', 0x5}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffff9}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0xa089, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x4980000, @dev={0xfe, 0x80, '\x00', 0x33}, 0x2}}}}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}]}]}, 0x260}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000b00)='/sys/power/resume', 0x4000, 0x1c) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000b40), 0x2, 0x1}}, 0x20) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=@bloom_filter={0x1e, 0x9, 0x0, 0x8, 0x20000, r4, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x1, 0x3}, 0x50) (async, rerun: 64) getsockopt$inet_tcp_buf(r4, 0x6, 0x1a, &(0x7f0000000c40)=""/120, &(0x7f0000000cc0)=0x78) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000d00), 0x200000, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r5, 0x82307202, &(0x7f0000000d40)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) fcntl$getownex(r4, 0x10, &(0x7f0000000f80)) (async) ioctl$KVM_TDX_INIT_MEM_REGION(r4, 0xc008aeba, &(0x7f0000001000)={0x3, 0x1, &(0x7f0000000fc0)={&(0x7f0000ffb000/0x4000)=nil, 0xdddd0000, 0x1}}) (async) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001100)={&(0x7f0000001080)={0x4c, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3f}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) fsopen(&(0x7f0000001180)='cramfs\x00', 0x0) (async, rerun: 32) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000011c0), r4) r6 = fsmount(r5, 0x0, 0x9) (async, rerun: 64) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000001200), &(0x7f0000001280)=0x68) (async, rerun: 64) io_uring_enter(r4, 0x4f89, 0xd0bc, 0x0, &(0x7f00000012c0)={[0x81]}, 0x8) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000001300)={{0x1, 0x1, 0x18, r0, {0x1ff}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r6, 0xc018937c, &(0x7f0000001340)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000000)={@multicast2, @empty}, 0x8) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=@acquire={0x134, 0x17, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d4, 0xff}, @in=@loopback, {@in=@multicast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e21, 0x100, 0x4e20, 0x3, 0x2, 0xe0, 0x20, 0x3b, 0x0, 0xffffffffffffffff}, {{@in6=@mcast2, @in=@broadcast, 0x4e21, 0x9, 0x4e22, 0x83, 0xa, 0x0, 0x0, 0xc}, {0x7f, 0xec2b, 0x5, 0xa, 0xd5, 0x6, 0x6, 0xb}, {0x7, 0xa0, 0x200000000009, 0x200000000000000}, 0xba, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x3, 0x1, 0x200, 0x70bd29}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x0, 0x7e, 0x80ff}}]}, 0x134}, 0x1, 0x0, 0x0, 0x24040040}, 0x0) recvmmsg(r0, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/177, 0xb1}, 0x5}], 0x1, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000006140)="e0332f8f5747b9f778142cc174a9b5f0244b78bb6346cb5fc9135b8220090ee698fddc241870359d32327f299718466d88c89e68097036bb35abfe03e3c02234dcdb2c7d1209c657485ca1aa3f2fb80e71397b80fca6f3cf2367fb19eb95e5b4a0170063374645d9e020099ffd7def3d94cd29412b3d7b7a47bc70121be848cfcecea78d41a93622b134bd06e84dec07a9e5abc29cb02d5b9091e748cffacf48352628822bab7b24a17bdf4b3f3bd9fb17793496aa6490da3f58039ce5b40745dd63f82d93bed80b50ca5742d67d39029a98db95c9392e2d5fd9a35bad30cfe98682b5a069738a12c3cfd25949106cfc839202fd21c2b28e44be73280d5037351ead2dd1c277d9cc9088c6b14365eb0937ea9685f6b26232293803260f2c8cfe176b55df304bc2865b8f52581afc4beed445ae8cc405cb7bcc51103aef812c41437c5b070a3591ad0964677f4f9017bb300727dfab009056bee3671a9694be2e2f2173fcc06ceba5aed0d93a3d7cd88365c5c354788efcc705e90d572e34e9e566fc206a8167970ecb9cbc43f4d9de4d43688582b6600dfcfc7379c831e756a45835647bd87879a3e3942c61b9ea2c2af35d49a4caa9a109b0beb972996ff8924ea371e15dc48efd12b1203a7f1fe354977fcf9e4ee2c8f210387e551ddb55e5f67ee6bb9bc8772649693b0adf24606e8ccc59f020834d8cbfcadfa1770549fe464dfc412308fbaee8d30bd20c002794bfb923bac6b490841248d12ad9a0e54d1d96e3aff5dc4930a6c8b7c75264a46af7a6339725fb84e0363463ebaaaf58d6b9309ae7c87a8df8c68d2487d684011de1fa7645f3f48cf3bb61bee8bcace2f8ef5f967f2765f8086aeaa5dcc34c84e379a7ddd6438cccb5b8098dfbffffffffffffeadbc4ad2b2ef98412a46f74a171ad056429dbb723cdb9ca9f9f03170dba2870e5988b7cb755599d1eb8f7eaf5c8ded4b56022cb479d0bdfae18f69f9ecc42f4c181ea10838229ba5db7f088ad8d5f77e49c1fd93ed6b983c43b23c7eeb1233f0c114885057a27cd3f67a309e3fecba241836bc92308b830b10b04af6c9595b44e859b9ca7ef079e151fdd500060787be3a7a5b3e23b06ec70f087134504f8b8e7b6799ebfe14f698ba7a813a380e6f92cace9230aa8094a2465f7224e2becad469d0aaf0e48b0098eacfb17abdb69bb2ebba97a09d2b739b532d70db91fcb0fcb38bccdc01d7c8113024ea8b619e385e58d31899721416e10b408504a9c4fcf870d21051227440a616cf62f6637b62eceaee09029f88009be02269cb5e5ed090c6f5e6c652c31214aef301bd23ec2504f90991cd27539c1b8b54db51825e951d076cd0e70f56de4b91894ce22049205483a0fe7d7886b36118bebd96d138980e26604b6e70a7275c6b81501143119a8c2c271558202eda196704ef9ae3c33301e1afbe56d069ce4926bf531d960f3df58192f3da558adc169d48d39e24e04e95c406b34b1f4ed2726ef0f6a67dd84c75636984191d019cebfa883fdf99affcdb4c874614a5312455403895891daf7469d6721583ccd1290ab05b14516f22965fc52c4a528f1a5c20cc133fea279d9efc991ec4d51d2654daceda234f6d3b0c635db697aba3eeaf8356319adba42428266ac09a6e6495ca8f60c1c4e052068511696296e88ef86a591948627ba97df634e0063eb5f208df00a069b1213c29e58cf76f591253d60de9d7c01d29992ccc728140299c429fec0df9d90f83fa2467ce00de83b16d10c7edb80ff8d4b1b19eea9bd1e2783a0d41215c9cf23bc3ca1ff414e3f29aadba00c5a8d5b44c28c10e99140e5428278e54bfd880a93fd1b54b560422ab2bfcf120a7902373b6442c6e9867b19aa0a6b77b1634ab6fd1c8a1d90d99ebb9ebcb89d593562b266fbc53c40501f9298690283c45059b3f6ee278e46cb3904c947446c28af8855b2a68e6e0c0da205a6e12fdd15b393d579039b31c1a54230ac2ea13cf1f5540046b4dcccdd731fff7323c4880e5d2d8668d8a7f08920715c17ef9652eb55f224c82a6fdb970dbf1032403f283bd868a23f4785a6ab9c0bcd2308dba1a1f258ae512cf64784e501008db366ab7093a6cc4b6ee86154d44a1a15c10834602dd5ccf730f6d1142ac19d113496dbcb80021cb5733924265d082a8453b5c21e0245e4a2627e8df090da6a129ee49c58c1a7437369acdee15f5e4e5638f05d9f6391572d9890219def702a013a2b05239664dba44feec2a9508a3200b47de03e6a784bca2f3633df534af33da0a95a34ca845b61a22ff55a5a4c04ff9e06e7162f458a8c56e106e75ffb76a921f4057dd73d5f3801aa78ca4c78d6b79bce560404c2fe3d57876287f73e84c27c486ffb997951f9e0b3aa81a5e7804ac7360add11e7851842d0ed8df041c999e50226fef006373bbb53d5d8e9d1653924e60234fd0b6645b821746f3d88591ff66e294e8e958ca425ddbc7d604f7cbbcb9d5fe0d4ad53878eb16bc801def1005e1eb12a6d4924d2179948e7aa542f2600ba3c6c600629d64c529c7326c1f38aa4e1a6cc259e58f86400d65d67856c8f4fffc33ad4c279dc05367307f562f8127f37b03c3cf38a97cfde0c02aad8ac40d347a9e0a496f227c068dc6c666fb2b6a18990f607399b0707d135752d93739e1840b5b4c125c81eeeb318869b408f87778451e49f3ad988a8aa97672989ad367833ff7e7f0e79c37ac794fe466623e122127fb94ebbc01bc775183b26b2dc407b1aa1a55d4ce04dbe1df4fba0377fea4c4bfa5a37c4dd733fd116b9c7f50b11dd512ad68646b9ddca295fe27bee78476901fbb5c8d2856ae0e9e21ab26e3587c1325f1fa28edb4081f2ba309d5fc39f7f54abbd0d5a152c2f7e3a8b3a5ef6e097b109061c91124f41f33055a7bb86706629f614d40346715cf2fe387ef4e4fc6646839824d3ef85eeac85bc5e681320f6fa7057e0a10de8c4678b48510f77b91bb397dd1209eaba8ea1f237c348e9e0d7af1229e2c04b6560e48e3a7491f3066b63a8923becdcfd8594c1c55098a51283b599765b049831cacd9478e5e996c778d524b476f6677218c94886d7548be7617e5796e35bb3c9b13d70e4897867d85f0350e9329985f051fb556b861aef7dead54e6b29b9ad837cb4774f47a5371ef034612aa0c151345546b876b53e9f2c06e3ce0113e67eba8842f4ac5b51a61315bf050078c710dcf14371d9593730b1d0302ef999f488bbf42b7360171da98ad68932bda4937358fd1d0c2bcd04f7dbe2beaffa0d53cccda316cb19270cf4aa56695ef3203b49fe92d1623cc1d714da6b8f94112db1781562ab2ae50bda23debd55da440434299c992f2f8c264310d6d8ccdd042737db0253d6889d8bf36fe99a131b73300c9798b8fd58b5fc681b97e71230cd3094e441fe5cf1294bbc28f41146f06e39d5e19e673dd489dbddfc16fe281160a8008e375025cbf25e84945f2f0a5ffb2cd58273328ea9d7533b2f0861eff95823cea18dc1877183fefab808bda0890f91f1d79b36953b138fd62caea3411900647a4afadfecade2ff6274175f06614d108daaf9821c413a137e33c826957953bb39e2d852097f978c3577abcb71d68b45794247d8e82614979708f6d6d0e469828206b22913d6d320d815d42c0d943640c63196f703f946089f535eac511e26c6a5a529e875eb15aaf65fd50dcbaf37a009f2f9081cdbc744cf7aa2336913e89f1961581ad4bb6aeb1d23a787e2d3f99639871df5842c30581263d5139128f0a3f37ef48bb636d7aae06581de6baa55a12019d3ed831950915fdc1eee819dd01047bda606f2852699529718c99606246a92bb1dd9435d8f3a48646c0e423441bc783be358c0c91e6846419b6c0a81354500cb2721834dc11ba40c3bbe5717e5142922a168ca0e20fc269ea584c7f68ff7cced62c4277385368b4ad596b79c45a9c4575c37f300cab37a5693cb777fabed412934d3a77505b17cb2628119ddff45f3fcbffb50386eb9cfb6f82b37fa852ad4b65bf8e2898b11bf051cb7fb0fa81cbf81b9ceebb05498aeb2691eb15297edd682976d5a4f444cdaa82f063bc4482c28c4e6257c7cf3e5ee5a502c6527b77b12725e7526ff896ee2f8066536dce04d63072a34c19d533d4dbdb93e7185482cbf7510c5eef2f8aebebad011727cd8061a367b7e1868252bb43d9a74c9c6a10539e357d5367fac69a9296fe5a79a2e5b45950ff462e0e882aa32ff7f29b5644e5311f3e0b076c58683de29ad9dd8b2c92a41ca8313ac997e44981e82aec550bbf6c88adf3d54e9fdf93d9dce95289e9086043d888f19d209cbea79f8f5b2c81b2c3889eae1cb5305e282b883c4cfa3798eceeabb442a74ff6a8470020a296ef01d8e32553663c844e67e5a3a44375f0074ce9547a6c489ee86d7652219491f35c6b904d51a26c3d2cc77d8ff97050dd0d0aed4a1ecf1db7ac48673a1dcc70ac16f709dcf4b90148aede5302111ceaa3a81c49b724cfa206283b62513f96c1da77efafe2d2d08a5f391ab690b5d974ceed2e95e85b1039def0e94c79cc0aa1de1f8133e985adfadf4a657710487b265bb6692fd2b91a06ac98d50b052b8a13168e2638b93209238fbe67f4590a81a2cdbcc479ca9178720a6ec05bc9457f27ad2e2fd2f4e9c643ef85b6287a01f7fd597799cce7d6464ed3c95110733d4ba92314ba3dd81e51f541a6e37f8bb14376e41560f9049b4ff349a467defc205f915a345b5f06d090645180ca642c719f03e9813bff7fd635660efe38b022130d42f2cedd792bcba2bfb14385c6d1cbe5ff2e38c22f1f8d5e4d93d296042507e43f24ff904827b16f2a3572d26078d7fdb0cfdbe2e6bee07b94ae441e510681c96f97ef0ddbd7efbd80ce0689f6e2022a189dd2937d3eadd82a154a5fac91b5ef48523706957b8d5f55077973e9a036009d745a6df39ba154dc59c4ef784d62b3f2d782dc508242a1b0e4cc294b6e62e98ef946f0d984c3174cf86b8a0beb615f046ec50dd0c8a9c0f36df60bd162f1130f894085e7c47b6c28ff336f5d75166c1840e7ad07204fc10ce976505f6aece0316d8c65b973f61cea2fe4c6db722717985c25249f041c07a86b878702a8c9ab7c33fe41039041aa38489b02a28f18d69ab34619e9e35514c54592c8059984ace64b5302b5f22d68c35c7ffb23c63ce877a1e1b160dd2c329eabcc0e1e3072021bd811de3c0c7a68af20ddb9e2912b7eecc2a8cf083a252d0fe31629b20559f7b976e4d8625644385c692b8cdc2886a42d750962d0dee10a1546ecb7ef961216cc456d2450a44aab07014fe0be076ca6bcb46b644af844b2ad8b3817f1895a5d579af3dc937541f4b7e9203e7a7af534b406d8f6e3bc555d767603122ab1c4e62de19d6af63be8e39fe45732859d6d92e11f1a847f7d62764b6364aa7f95f03cc7deba467da5be71657ae50ff6bf93c51efb7d19ac9887e92fe5f3c9d545209eff307c9e02073bd3404827e148aa63c135ed668589bdfec38cb47716201a9d02f1b03993f89e96b33b32e52ddffb0580dac45422ba7a3fef76e519a3dc8d12eac60c2d2f8c4303aafa3e80135c403360d51c9cdeba3ffb31e664302f587e0e983ede7f9b2bfe2bc64bd5029cfa88445e043e08f3e9affee25e980e75d2664738726e3d2eade7dce0ece78a514bbbe5a54c121374d079e3b05996052d66889742232b73e950e1a9892e7352c9e546a8cfb48332d2b2be6327208ca51dc2869a562581947f62b0d5bfb3e0911d4854f822d6738b4deb195840d2bbae0b074b8d1e1010c24ec00052dce7d259e3044aab1a99d261fb3b49cf09dfc85473f94db06d49e202ca12182283d48144f8389a5301679901600bf8130d36315b277a99204b85a1598f84bd2d4c4893108f6717bf44234181467d6eeee61e1823268b5c60bf04d0e13e429f411b51adfca20ff1a1b1eee203d59b03da1643c3e9fc474a91470116c6c5275542adb10f3adae2ae87e88b93f334e0ceb6216fc081e8d84d8b0a503196dc50599b22b89b807627b427a815aea0dbca69e5fb215ee996395d8a21a1c67ac295be33c6517504e1f00f579f8c484873cc670b5b9e787b1c30ca1f0b25f8bb8f4bde3b3f4fa730c292cbf97b25068ba9c65f78c555d5f75d52a57958d7111e824f3afa16484f625abf62afc80654c36fd9f8284466422fb18e08274e8febc719d45b784974d50d187ad2349429af3f7930252a4d45997762e9d5f5493d408ca144532aa89aa3d43c46951dafb8f81794e2e9679ce238cfe86e112f4f046d87feec3be04461032819d62f217faa71fa9dc6da8861015567d1f7309090e25b7015dcc6d72a5e7ba53296ab1bc72467ac50831628cf5238155aed3fb189a8b527ebd38771e16454fe51e3edde55cea454414690491207c23f6cf33aaeeda432de2d1ede04e039a16245e66cce6f4e4ea534f290f02a2a81a46d6ffea7967dfbe37461f83d472091156594852823392efc953f4ac099d74e2d0328d9f47bd952352981a34055acd0273309484ab56afa85ff0c22fb53ac5d7cc8e346b4c2f38a4e2451738146b7b90c14f826c7dbc1b2be79d83772a8d629f2dfaf15286a15be1ea22a05d4ee3de6a6bfb7e208dbbcc88e77baac940d6438aeeb77c3a32db08b46e79545b65f7f3c1bd433092bc9116668c338ab35c01cb5871167868c6b61bd4c0ca5f96e5ce2465da06c4a320839f3bb7c0dffd40d5bb9a32fcbc6f691787de7211da062616272c77c62ac83e4cb29fb954ab27d9009877b79be54acd336bfe2a6e087abaab004743f5ea4ec8ddfb8086920e8e458a413adb98077a3cf860513cc8a453eb129556c871be7e7232a6130c4332819ad17b289fdb31f8f8854dffb4cfeca6d792567b444c750820a2a8a2e0f93779e61a4966650909369fc8bd5bd2bad4ff95cc8a14f6cd83ae6411b4bfe1a9b5cdf1fcf32c54cef1731edc47d41fa581376b25006fc859b98805d70a157e501a2cb2ab425340965213adfecdb5addb2b4b2ec5cc6935e4e279bb98283fb20dfcd8a2c91aefda9dc5a57bba4d8803d1eb0f4ba9529de01e39c2aa60a91267c31d036a3f669b9377661837f58c6950fdf38986ea13ff5e9c4d966bf999002da1a854d54aa225b259d91eb88425328e7d13b06dea321a151a8dfc44755214da97168e8acf027d66b7fff45ded94fcde53ff80342d4595644549c4ed827225596e2b30480e94eb049b6cd718fe8424d044bb5098e0206047ddb81755e3cb92131dd47ec754b64c4b78f663e364cf8a74cdd9857c81316dc4ccd5f02a84b310abfbc9d6a23ee6d1eaf6b8fc1544cfeb06002c8a40fb0e49859d2073a7b1cb112713518ad5e007d0a256f901469bfa5cae98841f877faeb584d41bfe695da72ca5700ae085f39c99f769502ea9f43c0b84ca4611441d5adb3e5d0a426297e535258748169cad487f97d171c0630642943508206ce648aad2971297f3d4037d73e5fbc73460ca7401b7dbd7807273ae077a81fd0d4bc90b6068e3ec95afcfeab16619306fb23942a4308e8253b35f4912df392dfc5daf35dd842a5a1f78fc294cbdbd504056f0c7779121b5b3db7461e437347452476f3b0bb22e63aa23cb9d3e797c6c95513058d8fb2c27864ac0e1f5001c988e29c79bfa4236c7be41dee5561d825c1f0fbebc0c06cc4712e88ad5efd94f4eb4e93794af42a9752a2ebc57dc2f3881c75bbb23ad25b69619f9f5b07fe114ba291d2b5b4c1c175e1aa3ee3eda55e6126b3ad1e613bf8e0bbac727b879e7796fa0ad100893677a18b53f5eb31db43a97370d3749afa92fd0291fa96b05daa6beb43b9c1c11d9515976976d1cc1e44f35d317299ceb68ea2545f2a2b92b4e1046f6f92c33aae6995593189bb2611576599fd765b8e6fe2e88674ffd57ee8252287b1904d622c36a502db45c72b0d5fc3d983cc44bc955eb43911404667a4ab147d72b69ff2514dfb820ad75758e85df88499cea94ed658b4c1c2f49fe2bbb8d2dd97f844a6df289296cfb9cd5bc8d17aa235e2c4501b1422b25acd6dbc3a91d03904c545320524f9034955ab02f5d058097c37d23984baf808d28b3e12821eb8919a77c1b6a8bdeceecfcc487c39db592817dd378a7c5127b427e7279b2a82f6b8eec6b3fabe0947e353e7a386475b15011de93e2f2891f772ef90f4aba1ee1c4d7321c81ce4dcaa378daeabb93182c319494436dbe67d252a01291cacb59686ebd53c6df21c083e98fa299cf5e9b59f1ccea95c62b1437c8ff8754a6372b5b879ebc3241f6430871eafe35337d75cb68c42862846df4342ab434f7f0a7b9f66824e1e696e3dbecde179592774b7511e5a7a1a06ba601eb5f2a935c7cef0f83ecd412a84afdd05120fceb1afb6445ebfcdff8fffffffb75dddccc45afb4f5bb1308d39309c92c0b61a322d5229881fa5d598113cce54107036ca9f63fe863d257c706fe89d5c7ae59a459c6f15ba48d80da4aff541797b26418acddb987df3544bc4918cdbbdd8dd1bc2163c89635044e7b4da878457727a667c0146a12b4c46639497243259bfe4aa5ea50eb79f39fa9209256c9a685e3e39d6d8b6a9ca7d3554fbff0908ad6c6ecf68e506c20b16cd4a98e3ada9eb0cb3eb0b75b13b6d80bf99eddf2282da52cec085d3a725b71c29395d605e1eb26143290946a3a0d24347fa46145735dbf4eabc12150b8d5f7eeca804d7ed1fecd0132d1b94ebec65cbc07dfd4d54a5140567e77c646bd92666922c43aca8e482c59b970fa43087eb76d6715e4e8e5ebe54ca391383ef685b133534fcc1e5c5eb56f9d76a888506c4ac8d289c37039e0c4f927b0e11e85c5c7ec1cf4b19bebee6014cb89ee57f2ade8d166005e956d46a0c01f60b58299479e8a59a2e88f1a7ffd08b27d92fc2772b338959bd0a1c9cb95075c3cc17043c818345b29b76c0b8ed41c8c7259cc780c657cb9509daec1558453cfe061f54e08523a55d3223897559d51096b680802140800000000000000322e007c2af0c08867291dd732bfe4b24d1d5ae517a7f5903c369ac6b157d42eb6ca8c0d7b50fd533a56c814e7cf04db3012eebd53ec1b123d65ab1e462dc19182b690d56a88ad5a1f4d89f1749b005e88085505cc6d7de8eeee08def67bc1d1519d44b7a62dc07e491f328f786956d9200f00d78829e6af7c1a5835366201374b9487330920d4c57e2f7073292e173acc2424bb0d5e0e9448b4c02f9cfc99bc408110b6a3e9bc3799e4b178c2871069bc7d9ceba564378f02b2932c36f159478b5facd452b595a86d119216af9d860bd3997305320159a69a70fc62284141d23d2dc1e5394b271d99e5570450f1c55807e96c7cbe1b7c2e3e96f69fecf0f375e36e0d2acf319e37199e98486a8d145ce2d996c1909402744cce63664a75e480b197c345360321e830e5912d1d7bfe5a129a67fa98e6eda5268fa588047859daa11d087d0dbf0ccc7e120e3a5820cb4f5dc06748317e3f866518eb66e39dc8a68a7411b3403fc8eeab8283dee4d767e8e5842ed922e03ae5b3c9c494d5ebc61527ccd1222740fedd9e469ba6b30761cf387d654081c7e63182860e4548748058914a9cea01caf074fe6a78fafa2b45c516f9f20af9ac6773a400fa9661a872f6b55f0ed52a9be9e9c35502604b924f0eb628d6545da322e0713f9a5587e87e4b04fa495423b7c72093b764adfd1430a2e608b7af3d2bf80fef00e5b69abe386618274921ff57621bb99739de2e066ff17e95eba027f6a35170af3a69e93359a9643e155832d45c1aa9a8f71ad35504b99d3d0a1c11ae108664ea36f4dcded083aee17ac9efe7ee3fdf7b63c7c09bcef62caa88708510d45cea79d323083ddbfe7e5d3d9138f206a7af82ef1d26c85015c3e55a285a35d0052546493536b9061db27291a9292033753b7bddac63dac6f6271689240e43523c434a65e1d35299e386c953d0c92f21057e0b7883e049d20961e75069587eb3df6206496f76bbfd96635bb19837ba2ab193d79072ffb8829306b63697ff104a65031b8a38c24cca9ba23d5cdf753169a00fe2b2c3849f234a7029b657b3324c10d553e601aa97d17024f7bf5a99f96392f4a079a83daa27f4e3b512ee8536e764ce4dc36fd0874dfa502a693e55bd9f116202c5e906703e2c43d84448598b7af78aa60a205c152841e75e23436738ccaa6bbcef87e6a237d86d1a5e38e56c162cd6d61a4fb8b410b1643ad557a22348edfa82c23db11c9abdd8141fce263a66537512e93a930a4801ad862a902c7c1e00eb7c7466b1351318b7196c2a9016c55a05e104e124bdb568132f9397e31b10d04e5284bd029ea2f6a3ed11854e09b5871d6a725c21a9ef5d7e729a90a8206d5f61e6e42e47dda3e31b9134d47872a0dd7a576b665ec6ceaa5fd7d85ed7feede9ac9fc23e40241c0318077edda75b62eb271e28fb3705f7b4950c14b721a3a74a7a4e4de02cef5de76a1602b906016c0892ef37db51b0a1dd53f28b3d896f20abbad1ad0e0220960423267fc6e1779d1150fd584dd184bb43278d2d68ff21ac0daeef5408348cb80f4a9e0e606f6048bbaa517289451f084fffb63c5d904788cfc310b5495528a58f4650dafc4e4675b99d35ebab710ac6fefcee6c51a2835510fb6d2dbd8f97c3e53fb7a23c3f3c0283eb2271504581b9c1fa31e35c117e56a5d668a9c57df3b4e1129ca019a8b877fa4a22768dfbdd9d2154e17f4a7755b065090d88982471bfb242d89af5c6782693a6ab1b1be74dfa5655ac3b5ef4ace8dc595803cf4025bdf5c0e9fbe7a12a3a313311809591da08a2cc6cd8480dc960e1f79fa208440a0e589be5756c36d5830a51c4bdc39c2a85c0431bae3a7331b2ffdf23623693d343a7938a8a8a4dd4d523c6450a705bccbb38427f06f4f84a18adf303c0ddecf4ce2b6cdde4e09a4c31816195f0fe9f05fcdc0609f8a75ad2f23d5c24faaf346c13ec0512a5c29477ac561c878085d1a323f6bab08e2fb9ee57d7bb621ef21caf3609d74036c6dc1d7be0b6058d89dcb8d9aa4462fa0a740be66e3fdaa957f27c5a26dc586ac8c927ab2d7cf1b761798ea4191be8f4423cf1a6727d0c5f27a9969a753573afa584dea82678f3471ba36d726c396d68c671e579120f1a11cd50fa66b26fc2d6cb74ba07edbd5d3a288cf58ed1255381df02b2fb8983b7cf833433d1ab8fdef12651c3507e4b69fbc4b234678cca36761e8da434e5f036f204a1400da15277ef27ac140e2d574b89c0fd617da27e6ce862883bbe81c288834b9477d0d440c15dad505b363fcc1cfef8e2e3a96438809505844196acd0af751dedfced67f209c2ffa9c6da842c93ff4b5fd54a67df904f2f31b4236728c99582a667a8461d397770a657ffa7d514b0f076d7f35e9704a836e7882a2acf0a0ec2158ac7234953c3696abdc791c0b163ee76fbcc5adc18b6fa0f51f76f3d313a0d891f1deb69f6e44289b1aa43a768b8d13270959763a2c45129daeea493a5b0d7b36753b223dca9a8037368653400", 0x2000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x4, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 3: r0 = syz_clone(0xc0200400, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB='T\x00'], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4212, r0, &(0x7f00000001c0)={0xf7ffffffffffffbf}, &(0x7f0000000700)) syz_usb_connect(0x2, 0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003a12591405e043f0490fc010203010902380001010090050904000004441b5c0009050000000000000009050402000000000009058802"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_clone(0xc0200400, 0x0, 0x0, 0x0, 0x0, 0x0) (async) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB='T\x00'], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x0) (async) ptrace(0x10, r0) (async) ptrace$peeksig(0x4212, r0, &(0x7f00000001c0)={0xf7ffffffffffffbf}, &(0x7f0000000700)) (async) syz_usb_connect(0x2, 0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003a12591405e043f0490fc010203010902380001010090050904000004441b5c0009050000000000000009050402000000000009058802"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) (async) executing program 36: r0 = syz_clone(0xc0200400, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB='T\x00'], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4212, r0, &(0x7f00000001c0)={0xf7ffffffffffffbf}, &(0x7f0000000700)) syz_usb_connect(0x2, 0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003a12591405e043f0490fc010203010902380001010090050904000004441b5c0009050000000000000009050402000000000009058802"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_clone(0xc0200400, 0x0, 0x0, 0x0, 0x0, 0x0) (async) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB='T\x00'], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x0) (async) ptrace(0x10, r0) (async) ptrace$peeksig(0x4212, r0, &(0x7f00000001c0)={0xf7ffffffffffffbf}, &(0x7f0000000700)) (async) syz_usb_connect(0x2, 0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="12011003a12591405e043f0490fc010203010902380001010090050904000004441b5c0009050000000000000009050402000000000009058802"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) (async) executing program 5: r0 = socket(0x2b, 0x1, 0x1) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(r1, 0xe, &(0x7f0000000100)={0x8, 0x80000100008a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x14, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xb0, r5, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0x64010100}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xa00}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@private=0xa010102}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20040001}, 0x40) setsockopt$IPT_SO_SET_REPLACE(r0, 0x60, 0x40, 0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001040), r6) ftruncate(r0, 0x4) sendmsg$IEEE802154_ADD_IFACE(r6, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001080)={0x28, r7, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044000}, 0x20040000) executing program 5: syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000080000002505a3a44000000001ec126ede000101010000090400001202eb0000052406000005240000000d240f010000000000001e000009058202000200000009050d22"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x4b) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, 0xffffffffffffffff, 0x0) r2 = epoll_create1(0x80000) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000080)=0x40, 0x4) executing program 8: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="11000000040000000400000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000507010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000001500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 0: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000800)={0x7ff, 0xfffffffb, 0x2, {0x2, @sliced={0x10, [0xf1a7, 0x3882, 0x5, 0xffff, 0x6, 0x3, 0x9358, 0x2, 0x5, 0x7, 0x0, 0x40, 0x83, 0xc000, 0x0, 0x8001, 0x1, 0x2, 0x9, 0x2, 0x8, 0x734, 0x5, 0xe, 0xfff8, 0xd2b1, 0x8000, 0x3, 0x8, 0x2, 0x9, 0xdfa, 0x7, 0x0, 0x13, 0x6, 0x2, 0x65, 0x8, 0x4, 0x100, 0x101, 0x2, 0x9, 0x3, 0x9, 0x2, 0xbbba], 0x6}}, 0x80000001}) socket(0x10, 0x803, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0x8, 0x7, 0x5, 0x9, 0x8, 0x155b, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000002, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8c, 0x79, 0x2, 0x6e, 0x0, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5b84, 0x401, 0xc, 0x405, 0xa7, 0x81, 0x9, 0x5, 0xff977009, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd4f, 0x7, 0x400005, 0x2, 0x809, 0x4, 0x8e, 0x1000, 0x0, 0xdf, 0x3ffffd, 0x0, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x5, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff9, 0x401, 0x46, 0x10001, 0x4, 0xab02060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x7, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0xfff, 0x2e6bf781, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x61, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x403437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x6, 0x7f, 0x9d26, 0x10003, 0x1, 0x2, 0x2, 0x3, 0x40008003, 0xf45, 0x3, 0xd500, 0x8, 0x7ff, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0x8, 0x3, 0x5, 0x1afa, 0x7e, 0x8, 0x5, 0x3, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x9, 0x1e, 0x9, 0x81, 0x3, 0x1, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0x1, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffffd, 0xffff, 0x4, 0x463f, 0x80004, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400c001}, 0x289d) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) semctl$SEM_INFO(0x0, 0x4, 0x13, &(0x7f0000000240)=""/253) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 8: pipe2(&(0x7f00000030c0), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88403, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60200, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000500000000000000800000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 8: r0 = socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) (async) socket(0x2, 0x80805, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) (async, rerun: 64) socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 64) socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async) memfd_secret(0x0) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) r1 = syz_io_uring_setup(0x19f2, &(0x7f0000000080)={0x0, 0x4, 0x10100}, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x14, 0x1, 0x0, 0x0, 0x2f, @empty, @private0={0xfc, 0x0, '\x00', 0x1}}}) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[@ANYRES64=r4], 0x118) (async, rerun: 32) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) (async, rerun: 32) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x10, 0x0, 0xffffffffffffffff, 0x0}) io_uring_enter(r1, 0x2d3e, 0x0, 0x0, 0x0, 0x0) (async) ioperm(0x0, 0x2, 0x7e) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x34, r7, 0xd01, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x805}, 0x20000004) (async) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xac, r7, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xc, 0x5d}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "1ec1bc37716d67d60c0908e3ded21d21"}, @NL80211_ATTR_PMK={0x14, 0xfe, "4713fbbce06fbed2275b27e0f4989c3c"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="cb11befbf948"}, @NL80211_ATTR_SSID={0x1a, 0x34, @random="b0465f817191a771d0a5dd57b0c0e7a27806beaba4fd"}, @NL80211_ATTR_PMKID={0x14, 0x55, "17ecdb6bda673576e931f01e96d884ed"}, @NL80211_ATTR_PMKID={0x14, 0x55, "024edac795a88c2c17fec59393c5e6c1"}, @NL80211_ATTR_PMKID={0x14, 0x55, "4988239ec952438a3890a16713a0da3f"}]}, 0xac}, 0x1, 0x0, 0x0, 0x800}, 0x840) (async, rerun: 64) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120110019a16c9ee3b092702506f0102030109021200010607500e09040029019105"], 0x0) (rerun: 64) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c0000001d0a050000000000000000000a0000010c00104000000000100000020900010073797a31"], 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) executing program 8: setuid(0xee01) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) unlink(0x0) syz_usb_connect(0x2, 0x33, &(0x7f0000000240)={{0x12, 0x1, 0x310, 0xbf, 0x76, 0x90, 0x8, 0x499, 0x1040, 0x4a32, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x21, 0x1, 0x0, 0xb, 0x40, 0xe, [{{0x9, 0x4, 0x53, 0xb1, 0x1, 0x1e, 0xd1, 0x88, 0x5, [@generic={0x2, 0xf}], [{{0x9, 0x5, 0xc, 0x4, 0x200, 0xaa, 0x6, 0x3, [@generic={0x2, 0x2}, @generic={0x2, 0x26}]}}]}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x51, 0xf, 0xb, 0x1, 0x8, 0x3}, 0x0, 0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r0 = creat(&(0x7f0000000200)='./file1\x00', 0x2) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x4d, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7c7}}, 0x0, 0x0, 0x44, 0x0, "555084a86b5b70adccd1b755dda6542f402cc69d7e2c3f0886e049c1cd7667dd9090dd7ae6861dcc787c5e9bc420ed35f38cf5e1a1e663f2680cbb1a114b727493a002163947eac52f3baead79e87af3"}, 0xd8) r1 = syz_open_dev$sg(&(0x7f0000001a00), 0x0, 0x101000) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000001a40)) close(r0) socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0x9) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f00000000c0)=0xc) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000140)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r2}) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file1\x00', &(0x7f0000001200), 0xa, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000006800010003001000fdffff7f00000000000000000c0002000100000015000400060003"], 0x2c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x11, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000010000000083181f2db2ecc641a8ea4ade9a85bd42a319b317f425fc3e99e37d980d5ff8dbfbed4b7ac66143845a", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018440000030000000000000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0xf, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x4d}, 0x94) executing program 0: r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1a34, 0xf705, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x0, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) r5 = socket$igmp6(0xa, 0x3, 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db76cf059f40fa2640b6bfb74dd35391b8fa18479da9f4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847db97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ccfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000000000000000000003ba34b611569a451564d3a5400f9097ffe7a37e765be352be71ee24250d6828562c7e24cb763062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89a0000bde05c114e7a020fc1a5fd3eeeb822008b2d7d1cc062b51b0aca4956b557e51a1385cc572b0074b0950fb1437de2590bf99ec7ceb69e1fe2465fce099c992d57b804a22e148ae3411523814aee03ee2df877edfabf4aa94f07c6fdd127e57a8bf7975f2e606c25a299980a6e52fcf7849d45bb38573fbba8afef1aa7a24c805f7aee3e39a3000000000000000000000000000000000000878f88c4742ac490951c36c610a0d266588ec6a0bd300cf160b5a5d9e9fafa49ecc8430832d795e727b7fc2b76e7fc4141fdbb82f45d3cdd3fb8d4b443ab4954fdf5c1b9a6ab3e457f098329307ccb0a1989b6c37509692e952e7244f48bc12569ff8eb30d0f887b85b5ef44fb9a7571319190be0c226ed72f346cc4aa071ae0c72fa8bd00d5590c4f4ba65d0c8e1f4870fe3c414681e41b40163eb1aa2a7429a2208cd6e69c7d959e87da3fd0101159a03ab7fe78881ee7a1ee7a2edff75fb18a181e0c54352be2b7a5b5273198291c28d9141deeb3cdba5d414ae4b0000000000000000000000000009eacd83458d8a606be71970497a4fd4ca3b48ca482ab3804e2fac216b3ba613608b1a465456a33fd08491d337d7344c01cfc9e73"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r6, 0xc0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe3b, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0xffff, 0x9, 0xa, 0x52, 0x44a6, 0x5, 0x5, 0x8}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={@fallback=r5, 0xffffffffffffffff, 0x33, 0x2c, 0x0, @void, @void, @void, @value=r7}, 0x20) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="400316"], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 7: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, &(0x7f0000000040)={{0x8000009, 0x200004}, {0xddc6, 0xc}, 0x226a673f, 0x2}) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3e, &(0x7f0000000040)=0x5, 0x4) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f00000000c0)}, {&(0x7f0000000100)="e55f5aba7cded1d1e2c36d434d61735a4228ac266e3ade2692a229115d2b31019b57", 0x22}], 0x2) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {0x7fff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) mkdirat(r2, &(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x85) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000280)) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="7e0685a7a5014ca05aeda7fb3845b27c1400000031000701feffffffffdbdf25e07c0000"], 0x14}, 0x1, 0x0, 0x0, 0x24048881}, 0xc000) executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) landlock_restrict_self(r7, 0xe) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') socket$inet_udplite(0x2, 0x2, 0x88) executing program 5: pipe2(&(0x7f00000030c0), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88403, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60200, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000500000000000000800000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x3, [@func={0x1, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}, {0x0, [0x61]}}, 0x0, 0x3b}, 0x28) syz_usb_connect(0x3, 0x6b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403", @ANYRES8=0x0], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) executing program 5: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000800)={0x7ff, 0xfffffffb, 0x2, {0x2, @sliced={0x10, [0xf1a7, 0x3882, 0x5, 0xffff, 0x6, 0x3, 0x9358, 0x2, 0x5, 0x7, 0x0, 0x40, 0x83, 0xc000, 0x0, 0x8001, 0x1, 0x2, 0x9, 0x2, 0x8, 0x734, 0x5, 0xe, 0xfff8, 0xd2b1, 0x8000, 0x3, 0x8, 0x2, 0x9, 0xdfa, 0x7, 0x0, 0x13, 0x6, 0x2, 0x65, 0x8, 0x4, 0x100, 0x101, 0x2, 0x9, 0x3, 0x9, 0x2, 0xbbba], 0x6}}, 0x80000001}) socket(0x10, 0x803, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0x8, 0x7, 0x5, 0x9, 0x8, 0x155b, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000002, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8c, 0x79, 0x2, 0x6e, 0x0, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5b84, 0x401, 0xc, 0x405, 0xa7, 0x81, 0x9, 0x5, 0xff977009, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd4f, 0x7, 0x400005, 0x2, 0x809, 0x4, 0x8e, 0x1000, 0x0, 0xdf, 0x3ffffd, 0x0, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x5, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff9, 0x401, 0x46, 0x10001, 0x4, 0xab02060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x7, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0xfff, 0x2e6bf781, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x61, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x403437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x6, 0x7f, 0x9d26, 0x10003, 0x1, 0x2, 0x2, 0x3, 0x40008003, 0xf45, 0x3, 0xd500, 0x8, 0x7ff, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0x8, 0x3, 0x5, 0x1afa, 0x7e, 0x8, 0x5, 0x3, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x9, 0x1e, 0x9, 0x81, 0x3, 0x1, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0x1, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffffd, 0xffff, 0x4, 0x463f, 0x80004, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400c001}, 0x289d) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) semctl$SEM_INFO(0x0, 0x4, 0x13, &(0x7f0000000240)=""/253) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 9: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x3c}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="ad", 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x21, 0x301, 0x270bd24, 0x25dfdbfd, {0x1}}, 0x14}}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r2, 0x80045017, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$snddsp(r3, &(0x7f0000000040)="df00", 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r5 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='tvans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r6, @ANYBLOB=',\x00']) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r6, 0x4020565b, &(0x7f0000000600)={0x4, 0xff, 0x2}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000000)=@x86={0x6, 0x5, 0x17, 0x0, 0x3, 0xf9, 0x2, 0x79, 0xff, 0x8, 0x1, 0x5, 0x0, 0x8, 0x5, 0x8, 0x72, 0x7, 0xba, '\x00', 0x3}) ioctl$KVM_RUN(r5, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x7, 0x8, &(0x7f00000007c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd3}, [@exit, @exit, @ldst={0x0, 0x0, 0x2, 0x8, 0x3, 0xffffffffffffffc0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'vlan1\x00', 0x0}) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='mountinfo\x00') preadv(r8, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/196, 0xc4}], 0x1, 0x8, 0xffffffff) syz_emit_ethernet(0x5e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000e86dd65a680ee0028060100000000000000000000ffff00000000fe8000000000000000000000000000aa4e204e20", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0c2000690780000fb0000ca000000"], 0x0) sendmsg$nl_route(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1800006a00090029bd7000fbdbdf250a00000000000200"], 0x18}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r8) getsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f0000000140)={@private, @private}, &(0x7f0000000180)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f00000003c0)={'erspan0\x00', &(0x7f00000001c0)={'sit0\x00', r7, 0x10, 0x80, 0x2, 0x0, {{0x1e, 0x4, 0x3, 0x8, 0x78, 0x68, 0x0, 0x5, 0x2f, 0x0, @loopback, @broadcast, {[@ssrr={0x89, 0x1f, 0xd4, [@dev={0xac, 0x14, 0x14, 0x11}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0x33}, @multicast1, @multicast1]}, @noop, @timestamp_prespec={0x44, 0x3c, 0xc2, 0x3, 0x9, [{@broadcast, 0x2}, {@loopback, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@empty, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}, {@empty, 0xc27}, {@private=0xa010101, 0xffffff80}]}, @lsrr={0x83, 0x7, 0xfa, [@loopback]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f00000004c0)={'erspan0\x00', &(0x7f0000000400)={'syztnl1\x00', r7, 0x7, 0x0, 0x635c, 0x2, {{0x26, 0x4, 0x3, 0x8, 0x98, 0x65, 0x0, 0x1, 0x2f, 0x0, @empty, @rand_addr=0x64010100, {[@timestamp_addr={0x44, 0x44, 0x19, 0x1, 0xd, [{@broadcast, 0xfff0000}, {@local, 0x5}, {@broadcast, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xd4a}, {@remote, 0xc}, {@remote, 0x10001}, {@local, 0x8}, {@local, 0x8001}]}, @timestamp={0x44, 0x8, 0xad, 0x0, 0x8, [0xfed]}, @lsrr={0x83, 0xb, 0x8d, [@broadcast, @local]}, @timestamp_addr={0x44, 0x2c, 0xe, 0x1, 0xd, [{@rand_addr=0x64010102, 0x18000000}, {@dev={0xac, 0x14, 0x14, 0x16}, 0x3}, {@rand_addr=0x64010102, 0xffff1f1b}, {@remote}, {@local, 0x1}]}]}}}}}) executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x6, 0x9, &(0x7f00000002c0)={{0x2, @rand_addr, 0x0, 0x2, 'wlc\x00', 0x29, 0x2, 0x3}, {@dev={0xac, 0x14, 0x14, 0x3f}, 0xffff, 0x2, 0x0, 0x6a, 0x2}}, 0x44) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) syz_emit_ethernet(0xa6, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000fa", 0x70, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x3, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, '\x00'/12}]}}}}}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4286}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_UPDELAY={0x8, 0x4, 0x81}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r0, 0x0, 0x0) executing program 9: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)={0x24, r1, 0x301, 0x70bd2d, 0x27dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x9}]}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x21}, 0x0) r2 = fsopen(&(0x7f0000000140)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x9) fchdir(r3) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x7, 0x10}, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x38, 0x40, 0x107, 0xfffffffe, 0x25dfdbff, {0xf, 0x7c}, [@generic="27940e44e3a0c0211ed06c9b95fdbf962fa263", @nested={0xc, 0x5f, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048881}, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x802000, &(0x7f0000000140)='\x80\n') executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setreuid(0xffffffffffffffff, 0xee01) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, 0x0) executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000006100)=[{{&(0x7f0000002400)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000002240)=[{&(0x7f0000002580)=""/79, 0x4f}, {&(0x7f0000002600)=""/134, 0x86}], 0x2, &(0x7f00000026c0)=""/216, 0xd8}, 0x9}, {{&(0x7f00000027c0)=@hci, 0x80, &(0x7f0000002980)=[{&(0x7f0000002840)=""/98, 0x62}, {&(0x7f00000028c0)=""/159, 0x9f}], 0x2, &(0x7f00000029c0)=""/163, 0xa3}, 0xbc}, {{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000002a80)=""/50, 0x32}], 0x1, &(0x7f0000002b00)=""/23, 0x17}, 0x2c}, {{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f0000002b40)=""/15, 0xf}, {&(0x7f0000002b80)=""/135, 0x87}], 0x2, &(0x7f0000002c80)=""/99, 0x63}, 0xa}, {{&(0x7f0000002d00), 0x80, &(0x7f0000002e00)=[{&(0x7f0000002d80)=""/43, 0x2b}, {&(0x7f0000002dc0)=""/7, 0x7}], 0x2, &(0x7f0000002e40)=""/171, 0xab}}, {{&(0x7f0000002f00)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x80, &(0x7f0000005480)=[{&(0x7f0000002f80)=""/149, 0x95}, {&(0x7f0000003040)=""/109, 0x6d}, {&(0x7f00000030c0)=""/178, 0xb2}, {&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/103, 0x67}, {&(0x7f0000004200)=""/227, 0xe3}, {&(0x7f0000004300)=""/244, 0xf4}, {&(0x7f0000004400)=""/116, 0x74}, {&(0x7f0000004480)=""/4096, 0x1000}], 0x9, &(0x7f0000005540)=""/190, 0xbe}}, {{&(0x7f0000005600)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000005bc0)=[{&(0x7f0000005680)=""/232, 0xe8}, {&(0x7f0000005780)=""/74, 0x4a}, {&(0x7f0000005800)=""/70, 0x46}, {&(0x7f0000005880)=""/63, 0x3f}, {&(0x7f00000058c0)=""/19, 0x13}, {&(0x7f0000005900)=""/139, 0x8b}, {&(0x7f00000059c0)=""/44, 0x2c}, {&(0x7f0000005a00)=""/46, 0x2e}, {&(0x7f0000005a40)=""/197, 0xc5}, {&(0x7f0000005b40)=""/124, 0x7c}], 0xa, &(0x7f0000005c80)=""/34, 0x22}, 0x200}, {{&(0x7f0000005cc0)=@xdp, 0x80, &(0x7f0000006000)=[{&(0x7f0000005d40)=""/62, 0x3e}, {&(0x7f0000005d80)}, {&(0x7f0000005dc0)=""/154, 0x9a}, {&(0x7f0000005e80)=""/159, 0x9f}, {&(0x7f0000005f40)=""/189, 0xbd}], 0x5, &(0x7f0000006080)=""/100, 0x64}, 0x5}], 0x8, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000020c0)=ANY=[@ANYBLOB="1201000036571a20cd0c8000fe67010203010902120001000000000904000000cd76e30051ed04d58a03f8d362e0a26b0af93c2f4ece5fa9b186e0db183ba07f486ad6e32a8a09c5423737a702872df5aa7e484a5ee5d2192bf7f8460985186de063910acff890fccd57e9e49b90995e7b8aee4f296780993766cbaf211562f94fd641d84b52b78656a0a5710a26fa90773d3d64970bccad089f5723e46b569c97a0d506315544e5daf0b5"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000002380)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25d7dbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0x5, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x5e0, 0xde}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24018800}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000002380)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25d7dbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0x5, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x5e0, 0xde}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24018800}, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3d1, 0x3, 0x5, 0x6, 0x6}, 0x63}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xc804}, 0x2) r5 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) (async) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/18, @ANYRES32=r7, @ANYBLOB="0000000000004a641c0012000c"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/18, @ANYRES32=r7, @ANYBLOB="0000000000004a641c0012000c"], 0x3c}}, 0x0) close(r3) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = syz_open_dev$sndctrl(&(0x7f00000005c0), 0x2, 0x204100) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) read$FUSE(r9, &(0x7f0000000080)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$9p_fd(0x0, &(0x7f00000021c0)='./file0\x00', &(0x7f0000002200), 0x1001000, &(0x7f0000002480)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}, 0x2c, {[{@posixacl}, {@debug={'debug', 0x3d, 0x2}}, {@ignoreqv}, {@noextend}, {@privport}, {@msize={'msize', 0x3d, 0x8}}, {@mmap}], [{@euid_lt={'euid<', r10}}, {@obj_user={'obj_user', 0x3d, '/dev/net/tun\x00'}}, {@euid_gt}]}}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r8, 0x40405515, &(0x7f0000000640)={0x1, 0x2, 0x2, 0x3, 'syz1\x00', 0x8}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) socket$unix(0x1, 0x1, 0x0) (async) r11 = socket$unix(0x1, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x7, &(0x7f0000000680), 0x4) (async) setsockopt$inet6_int(r4, 0x29, 0x7, &(0x7f0000000680), 0x4) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r12, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="27030200000314000e00003c000300000000ff8400000000000000000000030000060000000085dc9d9839dc1336", 0x2e}], 0x1}, 0x4005) (async) sendmsg$kcm(r2, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r12, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="27030200000314000e00003c000300000000ff8400000000000000000000030000060000000085dc9d9839dc1336", 0x2e}], 0x1}, 0x4005) socket$packet(0x11, 0x2, 0x300) syz_open_dev$tty1(0xc, 0x4, 0x4) (async) r13 = syz_open_dev$tty1(0xc, 0x4, 0x4) writev(r13, &(0x7f0000000000)=[{&(0x7f0000000040)="ebfa0e81ceb3dc4c43c215dc4d15af003afa41ae5fbeb2c5ea34e359a91a0dc58e46f7c019be5b175c12cf29c48c2d4b45c1dc73113beeb9b5a73cd0415b0437839a7b9b3f", 0x45}], 0x1) executing program 9: socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x103) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008004}, 0x0) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAI'], 0x86) r0 = syz_open_dev$loop(&(0x7f00000000c0), 0xfffe, 0x14f600) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$LOOP_CONFIGURE(r0, 0xc0c0128e, &(0x7f0000000140)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8]}}) socket$inet_sctp(0x2, 0x1, 0x84) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@uuid_off, 0x3a}], [], 0x2f}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r1 = open_tree(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x1af18bc8) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x103) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008004}, 0x0) (async) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB='SYNTH \'Mic\' 00000000000000000000\nIGAI'], 0x86) (async) syz_open_dev$loop(&(0x7f00000000c0), 0xfffe, 0x14f600) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async) ioctl$LOOP_CONFIGURE(r0, 0xc0c0128e, &(0x7f0000000140)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8]}}) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@uuid_off, 0x3a}], [], 0x2f}) (async) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) open_tree(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) (async) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x1af18bc8) (async) executing program 7: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpgrp(0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000140)) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r2 = msgget$private(0x0, 0x1) msgctl$IPC_STAT(r2, 0x2, &(0x7f00000000c0)=""/80) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYRES8=r4], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000000)="e097566f5bec64466cf0925782dd", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002000)=""/102400, 0x19000) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e22, 0x1007e, @loopback, 0x1}, 0x1c) bind$inet6(r8, &(0x7f0000000240)={0xa, 0x4e22, 0x1007e, @loopback, 0x1}, 0x1c) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x34, 0x40, 0x107, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x6, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x80000001}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24048881}, 0xc000) listen(r7, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) executing program 7: sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000020603000000000000000000000000001400078008001240000000000500150002000000050001000600000005000500020000000500040000000000090002"], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x21, 0x5, 0xa) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='net/ip6_mr_cache\x00') lseek(r1, 0x2000, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) executing program 9: pipe2(&(0x7f00000030c0), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88403, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x60200, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000500000000000000800000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 9: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x8d}, [@ldst={0x4}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) write$qrtrtun(0xffffffffffffffff, &(0x7f0000000340)="66bb0b760dc0f4ff", 0x8) r0 = eventfd2(0x9, 0x801) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000000)=r0, 0x1) executing program 0: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x450001, 0x0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x5) (async) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x5) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000180)={0x9, 0x9, 0xfffffffd, 0xd0d, 0x6, "9b2fc5414d744ae20ecd4de62a25e68f35eb23"}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x400c0}, 0x4840) (async) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x400c0}, 0x4840) ioctl$XFS_IOC_FSGEOMETRY_V1(r0, 0x80705864, &(0x7f00000000c0)) executing program 9: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000800)={0x7ff, 0xfffffffb, 0x2, {0x2, @sliced={0x10, [0xf1a7, 0x3882, 0x5, 0xffff, 0x6, 0x3, 0x9358, 0x2, 0x5, 0x7, 0x0, 0x40, 0x83, 0xc000, 0x0, 0x8001, 0x1, 0x2, 0x9, 0x2, 0x8, 0x734, 0x5, 0xe, 0xfff8, 0xd2b1, 0x8000, 0x3, 0x8, 0x2, 0x9, 0xdfa, 0x7, 0x0, 0x13, 0x6, 0x2, 0x65, 0x8, 0x4, 0x100, 0x101, 0x2, 0x9, 0x3, 0x9, 0x2, 0xbbba], 0x6}}, 0x80000001}) socket(0x10, 0x803, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0x8, 0x7, 0x5, 0x9, 0x8, 0x155b, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000002, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8c, 0x79, 0x2, 0x6e, 0x0, 0x91, 0x4, 0x4, 0x16, 0x2, 0x5b84, 0x401, 0xc, 0x405, 0xa7, 0x81, 0x9, 0x5, 0xff977009, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd4f, 0x7, 0x400005, 0x2, 0x809, 0x4, 0x8e, 0x1000, 0x0, 0xdf, 0x3ffffd, 0x0, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x5, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff9, 0x401, 0x46, 0x10001, 0x4, 0xab02060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x7, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0xfffffffe, 0xfffffffe, 0xffff, 0xc, 0xfff, 0x2e6bf781, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x61, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x8000, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x403437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x6, 0x7f, 0x9d26, 0x10003, 0x1, 0x2, 0x2, 0x3, 0x40008003, 0xf45, 0x3, 0xd500, 0x8, 0x7ff, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0x8, 0x3, 0x5, 0x1afa, 0x7e, 0x8, 0x5, 0x3, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x9, 0x1e, 0x9, 0x81, 0x3, 0x1, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0x1, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffffd, 0xffff, 0x4, 0x463f, 0x80004, 0xdab, 0x3, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x2, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x10, 0x80000001, 0x3, 0x1, 0xd, 0xefe, 0x0, 0x0, 0x8}}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400c001}, 0x289d) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) semctl$SEM_INFO(0x0, 0x4, 0x13, &(0x7f0000000240)=""/253) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-landlock_create_ruleset-landlock_restrict_self-syz_open_procfs-socket$inet_udplite detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) landlock_restrict_self(r7, 0xe) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') socket$inet_udplite(0x2, 0x2, 0x88) program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-landlock_create_ruleset-landlock_restrict_self-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) landlock_restrict_self(r7, 0xe) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-landlock_create_ruleset-landlock_restrict_self detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) landlock_restrict_self(r7, 0xe) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-landlock_create_ruleset-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x1}, 0x18, 0x1) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-connect$inet6-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xf) r6 = fcntl$dupfd(r5, 0x406, r5) ioctl$TCFLSH(r6, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000140)=0x14) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-ioctl$TIOCSETD-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$TCFLSH(r5, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5412, &(0x7f0000000140)=0x14) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_init_net_socket$llc-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$TCFLSH(r5, 0x400455c8, 0x2) syz_init_net_socket$llc(0x1a, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-ioctl$TCFLSH-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$TCFLSH(r5, 0x400455c8, 0x2) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-fcntl$dupfd-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) fcntl$dupfd(r4, 0x406, r4) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-ioctl$TIOCSETD-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-openat$ptmx-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-socket$inet6_mptcp-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-write$cgroup_int-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f00000006c0)=0xd1b3, 0x12) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_UNIQUE-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r2, 0x40106410, &(0x7f00000001c0)={0x0, 0x0}) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_dev$dri-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-openat$ipvs-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-timer_settime-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-mprotect-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-fcntl$lock-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-timer_create-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-ioctl$vim2m_VIDIOC_ENUM_FMT-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x53, 0x1, 0x2, "bc574900fef306f3ff00000000007eed00000000000000000000000000001f00", 0x20493859}) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-accept$netrom-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept$netrom(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-bpf$PROG_LOAD-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$ptmx-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x240000, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-prctl$PR_GET_SPECULATION_CTRL-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-prctl$PR_GET_SPECULATION_CTRL-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_open_dev$vim2m-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) syz_open_dev$vim2m(&(0x7f0000000000), 0x20006, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(0x0, 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program did not crash testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program did not crash testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program did not crash testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_procfs detailed listing: executing program 0: syz_open_dev$dvb_frontend(&(0x7f00000015c0), 0x0, 0x400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release validation run: crashed=true reproducing took 1h53m29.312608283s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x410/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2916 Read of size 4 at addr ffff88802b75b83c by task syz.0.18/5958 CPU: 1 UID: 0 PID: 5958 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 dvb_frontend_release+0x410/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2916 __fput+0x45e/0xa80 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc97690bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffed13b68c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffed13b69b0 RCX: 00007fc97690bf79 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000195a3 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2d420000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc976b85fac R14: 00007fc976b85fa8 R15: 00007fc976b85fa0 Allocated by task 1: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5297 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] dvb_register_device+0x2fd/0x2210 drivers/media/dvb-core/dvbdev.c:475 dvb_register_frontend+0x665/0x970 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x9aa/0xf80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0xf9/0x190 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __driver_attach+0x349/0x640 drivers/base/dd.c:1227 bus_for_each_dev+0x23e/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x348/0x670 drivers/base/bus.c:715 driver_register+0x23a/0x320 drivers/base/driver.c:249 vidtv_bridge_init+0x28/0x50 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x250/0x840 init/main.c:1378 do_initcall_level+0x104/0x190 init/main.c:1440 do_initcalls+0x59/0xa0 init/main.c:1456 kernel_init_freeable+0x2a6/0x3d0 init/main.c:1688 kernel_init+0x1d/0x1d0 init/main.c:1578 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5958: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2670 [inline] slab_free mm/slub.c:6082 [inline] kfree+0x1c1/0x690 mm/slub.c:6399 dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put drivers/media/dvb-core/dvbdev.c:632 [inline] dvb_generic_release+0x123/0x1c0 drivers/media/dvb-core/dvbdev.c:169 dvb_frontend_release+0x138/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2914 __fput+0x45e/0xa80 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802b75b800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 60 bytes inside of freed 512-byte region [ffff88802b75b800, ffff88802b75ba00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b758 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813fe0dc80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0080000000000040 ffff88813fe0dc80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0080000000000002 ffffea0000add601 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2, tgid 2 (kthreadd), ts 14639760172, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884 prep_new_page mm/page_alloc.c:1892 [inline] get_page_from_freelist+0x28bb/0x2950 mm/page_alloc.c:3950 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5245 alloc_slab_page mm/slub.c:3238 [inline] allocate_slab+0x77/0x660 mm/slub.c:3411 new_slab mm/slub.c:3469 [inline] refill_objects+0x334/0x3c0 mm/slub.c:7091 refill_sheaf mm/slub.c:2787 [inline] __pcs_replace_empty_main+0x328/0x5f0 mm/slub.c:4536 alloc_from_pcs mm/slub.c:4639 [inline] slab_alloc_node mm/slub.c:4773 [inline] __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5292 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] set_kthread_struct+0xbb/0x340 kernel/kthread.c:125 copy_process+0x128c/0x3d00 kernel/fork.c:2152 kernel_clone+0x249/0x7f0 kernel/fork.c:2654 kernel_thread+0x13f/0x1b0 kernel/fork.c:2715 create_kthread kernel/kthread.c:490 [inline] kthreadd+0x4ec/0x6e0 kernel/kthread.c:849 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff88802b75b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802b75b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802b75b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802b75b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b75b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x410/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2916 Read of size 4 at addr ffff88802b75b83c by task syz.0.18/5958 CPU: 1 UID: 0 PID: 5958 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 dvb_frontend_release+0x410/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2916 __fput+0x45e/0xa80 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc97690bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffed13b68c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffed13b69b0 RCX: 00007fc97690bf79 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000195a3 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2d420000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc976b85fac R14: 00007fc976b85fa8 R15: 00007fc976b85fa0 Allocated by task 1: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5297 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] dvb_register_device+0x2fd/0x2210 drivers/media/dvb-core/dvbdev.c:475 dvb_register_frontend+0x665/0x970 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x9aa/0xf80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0xf9/0x190 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __driver_attach+0x349/0x640 drivers/base/dd.c:1227 bus_for_each_dev+0x23e/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x348/0x670 drivers/base/bus.c:715 driver_register+0x23a/0x320 drivers/base/driver.c:249 vidtv_bridge_init+0x28/0x50 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x250/0x840 init/main.c:1378 do_initcall_level+0x104/0x190 init/main.c:1440 do_initcalls+0x59/0xa0 init/main.c:1456 kernel_init_freeable+0x2a6/0x3d0 init/main.c:1688 kernel_init+0x1d/0x1d0 init/main.c:1578 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5958: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2670 [inline] slab_free mm/slub.c:6082 [inline] kfree+0x1c1/0x690 mm/slub.c:6399 dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put drivers/media/dvb-core/dvbdev.c:632 [inline] dvb_generic_release+0x123/0x1c0 drivers/media/dvb-core/dvbdev.c:169 dvb_frontend_release+0x138/0x4e0 drivers/media/dvb-core/dvb_frontend.c:2914 __fput+0x45e/0xa80 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802b75b800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 60 bytes inside of freed 512-byte region [ffff88802b75b800, ffff88802b75ba00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b758 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813fe0dc80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0080000000000040 ffff88813fe0dc80 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 0080000000000002 ffffea0000add601 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2, tgid 2 (kthreadd), ts 14639760172, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884 prep_new_page mm/page_alloc.c:1892 [inline] get_page_from_freelist+0x28bb/0x2950 mm/page_alloc.c:3950 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5245 alloc_slab_page mm/slub.c:3238 [inline] allocate_slab+0x77/0x660 mm/slub.c:3411 new_slab mm/slub.c:3469 [inline] refill_objects+0x334/0x3c0 mm/slub.c:7091 refill_sheaf mm/slub.c:2787 [inline] __pcs_replace_empty_main+0x328/0x5f0 mm/slub.c:4536 alloc_from_pcs mm/slub.c:4639 [inline] slab_alloc_node mm/slub.c:4773 [inline] __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5292 kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] set_kthread_struct+0xbb/0x340 kernel/kthread.c:125 copy_process+0x128c/0x3d00 kernel/fork.c:2152 kernel_clone+0x249/0x7f0 kernel/fork.c:2654 kernel_thread+0x13f/0x1b0 kernel/fork.c:2715 create_kthread kernel/kthread.c:490 [inline] kthreadd+0x4ec/0x6e0 kernel/kthread.c:849 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff88802b75b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802b75b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802b75b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802b75b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b75b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================