Extracting prog: 4m50.878185151s Minimizing prog: 23m25.354604679s Simplifying prog options: 0s Extracting C: 21.482152056s Simplifying C: 10m58.162270828s extracting reproducer from 24 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-open-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 30, 26, 5, 3, 30, 29, 27, 30, 30, 23, 3, 26, 30, 26, 27, 30, 26, 29, 23, 24, 3, 30, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r6, 0x104, 0x2) getdents64(r6, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 0: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', 0x0, &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 0: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x2, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) umount2(&(0x7f0000000340)='./file0\x00', 0x1) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', 0x0, 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, 0x0, 0x0, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r6, 0x104, 0x2) getdents64(r6, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 0: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) wait4(r0, 0x0, 0x8, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x3c, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_TUPLE_ORIG={0x4}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) mknod$loop(0x0, 0x6000, 0x1) mknod$loop(&(0x7f00000003c0)='./file1\x00', 0x6000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) io_uring_setup(0x17b1, &(0x7f0000000100)={0x0, 0xe7b5, 0x80, 0x20011, 0x1}) r4 = syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0xb, &(0x7f0000000040)=@conn_svc_rsp={0x0, 0x0, 0xa, "2046a2fc", {0x3, 0x1, 0x0, 0x5, 0x1f, 0xf8, 0x5}}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) landlock_restrict_self(r5, 0xe) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010005fba2a0070000000000000000000", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00000000000a0002000180c2000003000014001400776c616e3100"/48], 0x48}}, 0x800) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'veth0_virt_wifi\x00', @multicast}) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) dup(0xffffffffffffffff) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, 0x0, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 1: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', 0x0, &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 3: openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000280)={{0x4, 0xfffd, 0x8, 0xe1a4}, 'syz0\x00', 0x10}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x15) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}, @NFTA_RULE_USERDATA={0x4}]}], {0x14}}, 0x74}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x4c, 0x2, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040880}, 0x4001) socket$inet6(0xa, 0x1, 0x8010000000000084) openat$random(0xffffff9c, &(0x7f0000000100), 0x8000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x100008, 0x4, 0x8, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x1b, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, 0x2, r3}, 0x38) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001f00)=@newtaction={0x112c, 0x31, 0x1, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x11}, [{0x1118, 0x1, [@m_police={0x1114, 0x1, 0x0, 0x0, {{0xb}, {0x10e8, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x25242e8}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x5, 0xad8, 0x10001, 0x8001, 0x5, 0x7fff, 0xfffffff6, 0xfffffff4, 0x46, 0x5, 0x8, 0x0, 0x1, 0xd7, 0x0, 0x97, 0x8000, 0xa3, 0x3, 0x7, 0x100, 0x44a8, 0x6, 0x8001, 0x0, 0x7, 0xc4c7, 0x7ff, 0x44, 0x3, 0x0, 0x8, 0x8, 0x28, 0x8, 0x213580fd, 0x2, 0x1, 0x0, 0x5, 0x3, 0x31, 0x7, 0x200, 0x76, 0xec8a, 0x5, 0xe, 0x101, 0x0, 0xe5, 0xc, 0x5, 0x7, 0x4, 0x2, 0x0, 0x80dd, 0xb0, 0x35a26e02, 0xffff, 0xbf, 0x83b, 0x2, 0x200000, 0x8c, 0x2bf, 0x81a8, 0x8, 0x100, 0x3, 0x400, 0x0, 0x7, 0x2, 0x0, 0xffffffff, 0x6, 0x9, 0x237, 0x8, 0xb1, 0x7, 0x11, 0x3, 0xfd, 0xb55, 0x8000, 0x5, 0x6, 0xffffffcd, 0x2, 0x4, 0x80000000, 0x9, 0x7, 0x5, 0xc56a, 0x8, 0xffff, 0x2, 0x3, 0x5c, 0x8, 0x0, 0x6, 0x3, 0x50, 0x10000, 0x8001, 0x5, 0x1, 0x6, 0x7, 0xd, 0x9, 0x10000, 0x19, 0x91d, 0x3, 0x2, 0x1, 0x3, 0x3, 0x7ff, 0x401, 0x7, 0xd70, 0x2c, 0x9, 0x3, 0x6070, 0xfff, 0x1000, 0x8, 0x4, 0x6, 0x5, 0x4, 0x7c, 0x488531db, 0x40, 0x6, 0x5, 0xfffffffb, 0x1000000, 0x1ff, 0x5, 0xc7, 0x0, 0x8, 0x5, 0x5, 0x7, 0xfffffffb, 0x5, 0x5c, 0x1000, 0x3, 0x527, 0x3, 0x5a85, 0xf6, 0xc, 0x1, 0xaa7a, 0x6, 0x1, 0xee1, 0x80000000, 0x825f, 0x9, 0x40, 0x233, 0x80000001, 0x6, 0x401, 0x9, 0x618, 0x6, 0x4, 0x1, 0x846, 0x7, 0xb46, 0x9, 0x1ff, 0xe0, 0x4, 0xd, 0x1, 0xc98, 0x3, 0xffff8000, 0xc, 0x6, 0xfe, 0x1, 0x8, 0x2, 0x2, 0x2, 0xbecd, 0x9, 0x3, 0xba, 0x400, 0x8fe1, 0x371, 0x80, 0x2, 0x8000, 0x10000, 0x9, 0x5, 0x6e36c67d, 0xbe4, 0x7f, 0x1, 0x7, 0x2, 0x3, 0x1, 0x64, 0x8843, 0x6, 0x80, 0x3, 0x6, 0xfffffe01, 0x5, 0x8001, 0xfffffff7, 0x9, 0x9, 0x3ff, 0x751, 0x0, 0x1, 0x8, 0xfffffff3, 0xe, 0x7fff, 0xff, 0x800, 0x3, 0xd, 0x80000000, 0xe, 0xc0, 0x6, 0x6397, 0x9f9, 0x239, 0x89e4]}], [@TCA_POLICE_AVRATE={0x8, 0x4, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x38f43bb0}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x5e5, 0x0, 0x1, 0xa, 0x2, 0x5, 0x0, 0x5, 0x7, 0x2, 0x4, 0x0, 0x2, 0x1000, 0x7fffffff, 0x80, 0x6, 0x0, 0xffffffff, 0xaffc, 0x1, 0x34, 0x1, 0x4, 0x1, 0x5, 0x9, 0x4, 0x4, 0x1, 0x151d, 0x5, 0x6, 0xfffffffa, 0xd, 0xebc, 0x8, 0x752e, 0x8, 0x289, 0x100, 0xffffffff, 0x7f, 0x7fffffff, 0x101, 0x7f, 0x2, 0x5, 0x5, 0xfffffff7, 0x1, 0x5, 0x3, 0xd, 0x0, 0x7f, 0xffff2a91, 0x3, 0x100, 0x5, 0x2ce, 0x7f, 0xc14, 0xfff, 0x6, 0xfffffff7, 0x5, 0xd9, 0xffff6d2d, 0x7e, 0x0, 0x2, 0x4, 0xd1, 0x0, 0x0, 0x85, 0x1, 0xadfb, 0xd34, 0x9, 0xf324, 0x2000, 0x1, 0x5, 0x80, 0x1000, 0x0, 0x0, 0xecc1, 0xc, 0x1000, 0x7fffffff, 0x4, 0x4, 0x0, 0xfff, 0x7, 0x4, 0x7, 0x22, 0xa, 0x3, 0x2, 0x3e78, 0x134, 0x9, 0x80000001, 0x608, 0x80e8, 0x371, 0x8, 0x6f, 0x0, 0xfffff801, 0x6, 0x0, 0x4, 0x5, 0xffff, 0x0, 0x720fbc85, 0x101, 0x1ff, 0x48, 0xa3f, 0x4, 0xf46b, 0x9, 0x0, 0x4, 0x9, 0x401, 0x81, 0x84c, 0x6, 0x3, 0x5, 0xffff, 0x6, 0x7, 0x31a, 0xa, 0x9, 0xc16, 0x3ff, 0x0, 0x8001, 0x9, 0x1ff, 0x4, 0x68000000, 0x5, 0xfff, 0x800, 0x4, 0x30e9, 0x1, 0x9, 0x6, 0xec, 0x0, 0x7, 0x1, 0x8, 0xe0000, 0x0, 0x7, 0x8000000, 0x3, 0x7f, 0x1ff, 0x2, 0x9, 0x0, 0xfffffff1, 0xeb, 0x6, 0x10000, 0x0, 0x3, 0x6, 0x9, 0xdbe, 0x1000, 0x800, 0x3, 0x2, 0x3, 0x10001, 0xa, 0x7, 0x4, 0x4, 0xffffffff, 0x8, 0x0, 0x8000, 0x7, 0x8, 0x2, 0x8, 0x9, 0x238, 0x800, 0xffffffff, 0x4, 0x5, 0x9, 0x3c, 0x8000, 0x5, 0x1, 0x400, 0x2, 0xd, 0x200, 0xc, 0x2, 0x3, 0x1ff, 0x4, 0x0, 0x212c6b57, 0x75, 0x7, 0x70, 0xfffff219, 0xffffffc0, 0x2, 0x200, 0x6c, 0x7, 0x6, 0x9, 0x6bb1, 0x6, 0x8, 0x1, 0x9, 0x6a, 0xbf, 0x2, 0x2, 0x9, 0x9, 0x2, 0x9, 0x1, 0xc, 0x9, 0x8, 0x10000, 0x7, 0x3]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_TBF={0x3c, 0x1, {0x6000, 0x5, 0x757ab92d, 0x9b5, 0x3, {0x3, 0x0, 0x0, 0x3, 0x7, 0x8}, {0x1, 0x1, 0x3, 0xe5e, 0x7ff, 0x8}, 0xe, 0x8, 0x2}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x10000000, 0x5, 0x7fffffff, 0xfffffffe, {0x2, 0x2, 0x7, 0x8001, 0x101, 0x656}, {0x4, 0x1, 0x80, 0xfad, 0xe, 0x3}, 0x0, 0x9, 0xffff}}], [@TCA_POLICE_RESULT={0x8}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x8001}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x7fff}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}, @TCA_POLICE_RATE={0x404, 0x2, [0x100, 0x9, 0x3, 0xfffffff7, 0x1ff, 0x8, 0x4, 0x10000, 0x7fffffff, 0x0, 0x3ff, 0x9, 0x200, 0x7fff, 0x4, 0x8, 0x9000000, 0x1, 0xa, 0xffff751a, 0x1, 0x6, 0xc9e8, 0x8001, 0xffff, 0x9, 0xb, 0x8, 0x7, 0x100, 0xf, 0x2, 0x5, 0x38, 0x0, 0x5b2d, 0x0, 0x5, 0x5, 0x5, 0x9, 0x6, 0x3ff, 0x6, 0x5, 0x21, 0x1, 0x8, 0x9, 0x5, 0xf0c, 0x4, 0x1, 0xc48, 0x60000, 0x10001, 0x62e5, 0xf5, 0x3, 0x4, 0x6, 0x8, 0x6, 0x4, 0x7fff, 0x4, 0xb7, 0x4, 0x9, 0xdaff, 0xdca, 0x6711, 0x2, 0x6, 0x10001, 0x4, 0x101, 0x3, 0xde5, 0x3, 0x401, 0xffffffbc, 0x8000, 0x1, 0x6, 0xa9, 0x7, 0x9, 0x4, 0x8, 0x3, 0x1, 0xc, 0x4, 0x3, 0x6, 0x0, 0xf5, 0xf, 0x8, 0x1, 0x5, 0x3, 0x6b, 0x6, 0x8, 0x8001, 0x4, 0x0, 0x7, 0x7fff, 0x4, 0x0, 0x8, 0x9f4d, 0x9, 0x1000, 0xa10, 0x6, 0x0, 0x7, 0x7, 0x5, 0x1, 0x4, 0xfffffff7, 0x7fff, 0x9, 0x3, 0x5, 0x717, 0x5, 0x5, 0x4, 0x75, 0x401, 0x6, 0x5, 0x7, 0xd9e, 0x0, 0x7, 0x0, 0x97e2, 0x6, 0x6, 0x1ff, 0x6, 0xfffffffa, 0x2, 0x1000, 0x4, 0x800, 0xfffffff9, 0x8001, 0x3, 0x6, 0x69, 0x0, 0x6, 0x401, 0x474, 0x6, 0x1, 0x0, 0x7b75b7e8, 0xd, 0x401, 0xff, 0x3, 0xd93a, 0x6, 0xb98, 0x0, 0x401, 0x2, 0x6, 0x58, 0x3, 0x38f08769, 0xa78e, 0x7, 0x6, 0x7fff, 0x5, 0xa1b6, 0x5e5a, 0x9, 0x1, 0x1, 0x2, 0x1, 0x6, 0x2, 0xff, 0x4000, 0x0, 0x3, 0xb, 0x9, 0xc060da9, 0x8, 0xfffffffc, 0x0, 0x0, 0x1, 0x6, 0x9, 0x10, 0xa2, 0x2, 0xfffffffc, 0x10, 0x5, 0x4, 0x7392, 0x1, 0x2, 0x6, 0x6, 0x4, 0x9, 0xb1e2, 0x2, 0x1, 0xff, 0x6281, 0x5f, 0xc, 0x0, 0x2, 0x0, 0x7, 0xf987, 0xfffffff7, 0x3, 0x8, 0x2, 0x401, 0x6, 0x2, 0xb, 0x80, 0xfffffff7, 0x1, 0xffffad25, 0xa03, 0xff, 0x0, 0x2, 0x4, 0x4, 0x81, 0x4, 0x3, 0xf]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x8, 0xd4e4, 0x40, 0x3, 0x6, 0x64b8, 0x155a, 0x1000, 0x5dd900, 0x7ff, 0x2800000, 0x401, 0x5d, 0x6, 0xffff, 0x6, 0x80, 0x101, 0x3005f5ab, 0x3b7e6b03, 0xfff, 0x5, 0x2, 0x10000, 0xe, 0x8, 0x4, 0x8, 0x2, 0x7fffffff, 0x566, 0xb1, 0x5, 0x0, 0x0, 0x4, 0x81, 0x1, 0x8, 0x10001, 0x3, 0x0, 0x30000, 0x2, 0x0, 0x1, 0x0, 0x2, 0x2, 0x1, 0x0, 0x2, 0x0, 0x5, 0x1, 0x7, 0x1, 0x5, 0x1, 0x1000, 0x9, 0xfffffffb, 0x8, 0x3, 0xc00000, 0x5da, 0xffff7fff, 0x787, 0x7, 0x5, 0x8, 0x6a65, 0x1, 0x0, 0x5, 0xd6, 0x9, 0x6, 0x3, 0xa, 0xa0b0, 0xffffff81, 0x3ff, 0x1ff, 0xfffffff6, 0xa, 0xf, 0x6, 0x6, 0x7fffffff, 0x3, 0x10000, 0x31a2, 0x10000, 0x9, 0x5d86a571, 0x101, 0x8, 0x9, 0x1, 0x3, 0x2, 0x3, 0xa361, 0x4, 0xfffffff8, 0x80000000, 0x10001, 0xe, 0x2, 0x3d7a3cad, 0xcba, 0x7, 0x8, 0x7, 0x4, 0x800, 0x2, 0x2, 0x7, 0xfffffe00, 0x9, 0xbb7, 0x10, 0x9, 0x1, 0x5, 0x0, 0xff, 0xf, 0x45f, 0x7, 0x6, 0x9, 0x3, 0x7, 0x9, 0xfffffc01, 0x1b9, 0x1ff, 0x10000, 0x2, 0x8, 0xf, 0x5, 0x2, 0x3, 0xecd4, 0xd7, 0x7, 0x6, 0x7, 0x5, 0x7, 0x4, 0x78ad195f, 0x2, 0x6, 0xc, 0x1, 0x7, 0x76, 0xffffffff, 0x4, 0x8, 0x3, 0x7, 0x4, 0x400, 0x5, 0x0, 0x7, 0x2, 0xff, 0xbcdc, 0x40, 0x5, 0x5, 0x2, 0x9, 0x1, 0x2, 0x6, 0x3, 0x39f6, 0xfff, 0x40, 0x5, 0xbf, 0xe8, 0x7fff, 0x2, 0x8, 0x10000, 0x80000001, 0x5, 0x3, 0xc7, 0x7ff, 0x0, 0xfffffff9, 0x3, 0xd23, 0x4, 0x66, 0x2, 0xffffffff, 0x6, 0x9, 0x5, 0x4, 0x8, 0x7, 0xd, 0x7, 0x9, 0x2, 0x5, 0xffffffd4, 0x0, 0xfff, 0x0, 0x6, 0x200, 0x0, 0x0, 0x2, 0x0, 0x7f, 0xfffff801, 0x8, 0x4, 0x9, 0x3, 0x9, 0x2, 0x0, 0xfff, 0x800, 0x9, 0x40, 0x5, 0xfffffffb, 0x8, 0x799, 0x4, 0x3, 0x9, 0x80, 0x3, 0x4, 0x7f, 0x0, 0x4, 0x57]}]]}, {0x4}, {0xc, 0x3, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x112c}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000001780)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x45}, @l2cap_cid_signaling={{0x41}, [@l2cap_conn_req={{0x2, 0x3, 0x4}, {0xfff, 0xffff}}, @l2cap_conf_req={{0x4, 0x8, 0xc}, {0x0, 0x75cb, [@l2cap_conf_ews={0x7, 0x2, 0x5}, @l2cap_conf_ews={0x7, 0x2, 0x9d5}]}}, @l2cap_conf_rsp={{0x5, 0x3, 0x11}, {0x8000, 0xb59, 0x0, [@l2cap_conf_ews={0x7, 0x2, 0x30}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_flushto={0x2, 0x2, 0x4}]}}, @l2cap_create_chan_rsp={{0xd, 0x3, 0x8}, {0x3, 0x37f5, 0xe9, 0x5}}, @l2cap_disconn_req={{0x6, 0xc, 0x4}, {0x7, 0x1}}]}}, 0x4a) flock(0xffffffffffffffff, 0x2) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x80) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000003010101000000001646741400000000"], 0x14}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x10}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x80) sendmsg(r0, &(0x7f0000000540)={&(0x7f0000000040)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-twofish-avx\x00'}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000300)="80ba9fe37fe15a4003faed2aa9e3563d271030df15105f522e579c6c6290bec90b4f8210a0f02e15b44b489261f66f7b55590ab6b57c91bdfaddcdd76da1e17c1ebd1e6fe8d347d26d9c22ca75fd4066debe5346f9f1de6ca20ded2e2265a6fe8a9d3311508e0033abbbc5dce4fd4276b6c2af72fae05562868f55a38d65bfbe0a81875ed4d0fc68df802cae8bdf976328000b906deb7ff649363e341a34c8903dbefef1cd63a4286405f603e1d0030aa2b26c16d22f0187b6dc372249d5a70f1640e3f1736951", 0xc7}, {&(0x7f0000000400)="d0b60c8e4f23a541b142399ff1171fa464f6ae93c7", 0x15}, {&(0x7f0000000440)="e9a382cb415c427737332b8793744a6be8d7063a063237bcf02ffe0958161a027232e909508c526f5c29b0100731cea6caf22ab49719088c2e23b01798773e78c866f04dfe7a527ff46ce7ae8ce7270e7781918b961b75bbb891fca4d623a9a3e44ce3ed334a95add657e440a499931b6b362c0f1822b33bc546bab04a2c5de7d9e2579627b52afa2674f1006f0fa1eddc61d85163c02964c7f1adc2afef586ebcecd72c22bf894a35299b24ae1d8ac4d64986987490912196780ef837", 0xbd}], 0x3}, 0x1) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 1: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) wait4(r0, 0x0, 0x8, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x38, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) mknod$loop(0x0, 0x6000, 0x1) mknod$loop(&(0x7f00000003c0)='./file1\x00', 0x6000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) io_uring_setup(0x17b1, &(0x7f0000000100)={0x0, 0xe7b5, 0x80, 0x20011, 0x1}) r4 = syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0xb, &(0x7f0000000040)=@conn_svc_rsp={0x0, 0x0, 0xa, "2046a2fc", {0x3, 0x1, 0x0, 0x5, 0x1f, 0xf8, 0x5}}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) landlock_restrict_self(r5, 0xe) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010005fba2a0070000000000000000000", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00000000000a0002000180c2000003000014001400776c616e3100"/48], 0x48}}, 0x800) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'veth0_virt_wifi\x00', @multicast}) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) dup(0xffffffffffffffff) executing program 2: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 3: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7021000", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r6, 0x104, 0x2) getdents64(r6, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 3: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x4001af84, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000380)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='0', 0x1) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x4048aecb, &(0x7f0000000300)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write$P9_RSTATu(r7, &(0x7f0000000000)=ANY=[], 0x1e) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 0: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: bisecting 24 programs bisect: split chunks (needed=false): <23> bisect: split chunk #0 of len 23 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 23, 3, 26, 30, 26, 27, 30, 26, 29, 23, 24, 3, 30, 30] detailed listing: executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, 0x0, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 1: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', 0x0, &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipe\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 3: openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000280)={{0x4, 0xfffd, 0x8, 0xe1a4}, 'syz0\x00', 0x10}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x15) ioctl$UI_DEV_SETUP(r2, 0x5501, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}, @NFTA_RULE_USERDATA={0x4}]}], {0x14}}, 0x74}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x4c, 0x2, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040880}, 0x4001) socket$inet6(0xa, 0x1, 0x8010000000000084) openat$random(0xffffff9c, &(0x7f0000000100), 0x8000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x100008, 0x4, 0x8, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x1b, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, 0x2, r3}, 0x38) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001f00)=@newtaction={0x112c, 0x31, 0x1, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x11}, [{0x1118, 0x1, [@m_police={0x1114, 0x1, 0x0, 0x0, {{0xb}, {0x10e8, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x25242e8}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x5, 0xad8, 0x10001, 0x8001, 0x5, 0x7fff, 0xfffffff6, 0xfffffff4, 0x46, 0x5, 0x8, 0x0, 0x1, 0xd7, 0x0, 0x97, 0x8000, 0xa3, 0x3, 0x7, 0x100, 0x44a8, 0x6, 0x8001, 0x0, 0x7, 0xc4c7, 0x7ff, 0x44, 0x3, 0x0, 0x8, 0x8, 0x28, 0x8, 0x213580fd, 0x2, 0x1, 0x0, 0x5, 0x3, 0x31, 0x7, 0x200, 0x76, 0xec8a, 0x5, 0xe, 0x101, 0x0, 0xe5, 0xc, 0x5, 0x7, 0x4, 0x2, 0x0, 0x80dd, 0xb0, 0x35a26e02, 0xffff, 0xbf, 0x83b, 0x2, 0x200000, 0x8c, 0x2bf, 0x81a8, 0x8, 0x100, 0x3, 0x400, 0x0, 0x7, 0x2, 0x0, 0xffffffff, 0x6, 0x9, 0x237, 0x8, 0xb1, 0x7, 0x11, 0x3, 0xfd, 0xb55, 0x8000, 0x5, 0x6, 0xffffffcd, 0x2, 0x4, 0x80000000, 0x9, 0x7, 0x5, 0xc56a, 0x8, 0xffff, 0x2, 0x3, 0x5c, 0x8, 0x0, 0x6, 0x3, 0x50, 0x10000, 0x8001, 0x5, 0x1, 0x6, 0x7, 0xd, 0x9, 0x10000, 0x19, 0x91d, 0x3, 0x2, 0x1, 0x3, 0x3, 0x7ff, 0x401, 0x7, 0xd70, 0x2c, 0x9, 0x3, 0x6070, 0xfff, 0x1000, 0x8, 0x4, 0x6, 0x5, 0x4, 0x7c, 0x488531db, 0x40, 0x6, 0x5, 0xfffffffb, 0x1000000, 0x1ff, 0x5, 0xc7, 0x0, 0x8, 0x5, 0x5, 0x7, 0xfffffffb, 0x5, 0x5c, 0x1000, 0x3, 0x527, 0x3, 0x5a85, 0xf6, 0xc, 0x1, 0xaa7a, 0x6, 0x1, 0xee1, 0x80000000, 0x825f, 0x9, 0x40, 0x233, 0x80000001, 0x6, 0x401, 0x9, 0x618, 0x6, 0x4, 0x1, 0x846, 0x7, 0xb46, 0x9, 0x1ff, 0xe0, 0x4, 0xd, 0x1, 0xc98, 0x3, 0xffff8000, 0xc, 0x6, 0xfe, 0x1, 0x8, 0x2, 0x2, 0x2, 0xbecd, 0x9, 0x3, 0xba, 0x400, 0x8fe1, 0x371, 0x80, 0x2, 0x8000, 0x10000, 0x9, 0x5, 0x6e36c67d, 0xbe4, 0x7f, 0x1, 0x7, 0x2, 0x3, 0x1, 0x64, 0x8843, 0x6, 0x80, 0x3, 0x6, 0xfffffe01, 0x5, 0x8001, 0xfffffff7, 0x9, 0x9, 0x3ff, 0x751, 0x0, 0x1, 0x8, 0xfffffff3, 0xe, 0x7fff, 0xff, 0x800, 0x3, 0xd, 0x80000000, 0xe, 0xc0, 0x6, 0x6397, 0x9f9, 0x239, 0x89e4]}], [@TCA_POLICE_AVRATE={0x8, 0x4, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x38f43bb0}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x5e5, 0x0, 0x1, 0xa, 0x2, 0x5, 0x0, 0x5, 0x7, 0x2, 0x4, 0x0, 0x2, 0x1000, 0x7fffffff, 0x80, 0x6, 0x0, 0xffffffff, 0xaffc, 0x1, 0x34, 0x1, 0x4, 0x1, 0x5, 0x9, 0x4, 0x4, 0x1, 0x151d, 0x5, 0x6, 0xfffffffa, 0xd, 0xebc, 0x8, 0x752e, 0x8, 0x289, 0x100, 0xffffffff, 0x7f, 0x7fffffff, 0x101, 0x7f, 0x2, 0x5, 0x5, 0xfffffff7, 0x1, 0x5, 0x3, 0xd, 0x0, 0x7f, 0xffff2a91, 0x3, 0x100, 0x5, 0x2ce, 0x7f, 0xc14, 0xfff, 0x6, 0xfffffff7, 0x5, 0xd9, 0xffff6d2d, 0x7e, 0x0, 0x2, 0x4, 0xd1, 0x0, 0x0, 0x85, 0x1, 0xadfb, 0xd34, 0x9, 0xf324, 0x2000, 0x1, 0x5, 0x80, 0x1000, 0x0, 0x0, 0xecc1, 0xc, 0x1000, 0x7fffffff, 0x4, 0x4, 0x0, 0xfff, 0x7, 0x4, 0x7, 0x22, 0xa, 0x3, 0x2, 0x3e78, 0x134, 0x9, 0x80000001, 0x608, 0x80e8, 0x371, 0x8, 0x6f, 0x0, 0xfffff801, 0x6, 0x0, 0x4, 0x5, 0xffff, 0x0, 0x720fbc85, 0x101, 0x1ff, 0x48, 0xa3f, 0x4, 0xf46b, 0x9, 0x0, 0x4, 0x9, 0x401, 0x81, 0x84c, 0x6, 0x3, 0x5, 0xffff, 0x6, 0x7, 0x31a, 0xa, 0x9, 0xc16, 0x3ff, 0x0, 0x8001, 0x9, 0x1ff, 0x4, 0x68000000, 0x5, 0xfff, 0x800, 0x4, 0x30e9, 0x1, 0x9, 0x6, 0xec, 0x0, 0x7, 0x1, 0x8, 0xe0000, 0x0, 0x7, 0x8000000, 0x3, 0x7f, 0x1ff, 0x2, 0x9, 0x0, 0xfffffff1, 0xeb, 0x6, 0x10000, 0x0, 0x3, 0x6, 0x9, 0xdbe, 0x1000, 0x800, 0x3, 0x2, 0x3, 0x10001, 0xa, 0x7, 0x4, 0x4, 0xffffffff, 0x8, 0x0, 0x8000, 0x7, 0x8, 0x2, 0x8, 0x9, 0x238, 0x800, 0xffffffff, 0x4, 0x5, 0x9, 0x3c, 0x8000, 0x5, 0x1, 0x400, 0x2, 0xd, 0x200, 0xc, 0x2, 0x3, 0x1ff, 0x4, 0x0, 0x212c6b57, 0x75, 0x7, 0x70, 0xfffff219, 0xffffffc0, 0x2, 0x200, 0x6c, 0x7, 0x6, 0x9, 0x6bb1, 0x6, 0x8, 0x1, 0x9, 0x6a, 0xbf, 0x2, 0x2, 0x9, 0x9, 0x2, 0x9, 0x1, 0xc, 0x9, 0x8, 0x10000, 0x7, 0x3]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_TBF={0x3c, 0x1, {0x6000, 0x5, 0x757ab92d, 0x9b5, 0x3, {0x3, 0x0, 0x0, 0x3, 0x7, 0x8}, {0x1, 0x1, 0x3, 0xe5e, 0x7ff, 0x8}, 0xe, 0x8, 0x2}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x10000000, 0x5, 0x7fffffff, 0xfffffffe, {0x2, 0x2, 0x7, 0x8001, 0x101, 0x656}, {0x4, 0x1, 0x80, 0xfad, 0xe, 0x3}, 0x0, 0x9, 0xffff}}], [@TCA_POLICE_RESULT={0x8}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x8001}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x7fff}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}, @TCA_POLICE_RATE={0x404, 0x2, [0x100, 0x9, 0x3, 0xfffffff7, 0x1ff, 0x8, 0x4, 0x10000, 0x7fffffff, 0x0, 0x3ff, 0x9, 0x200, 0x7fff, 0x4, 0x8, 0x9000000, 0x1, 0xa, 0xffff751a, 0x1, 0x6, 0xc9e8, 0x8001, 0xffff, 0x9, 0xb, 0x8, 0x7, 0x100, 0xf, 0x2, 0x5, 0x38, 0x0, 0x5b2d, 0x0, 0x5, 0x5, 0x5, 0x9, 0x6, 0x3ff, 0x6, 0x5, 0x21, 0x1, 0x8, 0x9, 0x5, 0xf0c, 0x4, 0x1, 0xc48, 0x60000, 0x10001, 0x62e5, 0xf5, 0x3, 0x4, 0x6, 0x8, 0x6, 0x4, 0x7fff, 0x4, 0xb7, 0x4, 0x9, 0xdaff, 0xdca, 0x6711, 0x2, 0x6, 0x10001, 0x4, 0x101, 0x3, 0xde5, 0x3, 0x401, 0xffffffbc, 0x8000, 0x1, 0x6, 0xa9, 0x7, 0x9, 0x4, 0x8, 0x3, 0x1, 0xc, 0x4, 0x3, 0x6, 0x0, 0xf5, 0xf, 0x8, 0x1, 0x5, 0x3, 0x6b, 0x6, 0x8, 0x8001, 0x4, 0x0, 0x7, 0x7fff, 0x4, 0x0, 0x8, 0x9f4d, 0x9, 0x1000, 0xa10, 0x6, 0x0, 0x7, 0x7, 0x5, 0x1, 0x4, 0xfffffff7, 0x7fff, 0x9, 0x3, 0x5, 0x717, 0x5, 0x5, 0x4, 0x75, 0x401, 0x6, 0x5, 0x7, 0xd9e, 0x0, 0x7, 0x0, 0x97e2, 0x6, 0x6, 0x1ff, 0x6, 0xfffffffa, 0x2, 0x1000, 0x4, 0x800, 0xfffffff9, 0x8001, 0x3, 0x6, 0x69, 0x0, 0x6, 0x401, 0x474, 0x6, 0x1, 0x0, 0x7b75b7e8, 0xd, 0x401, 0xff, 0x3, 0xd93a, 0x6, 0xb98, 0x0, 0x401, 0x2, 0x6, 0x58, 0x3, 0x38f08769, 0xa78e, 0x7, 0x6, 0x7fff, 0x5, 0xa1b6, 0x5e5a, 0x9, 0x1, 0x1, 0x2, 0x1, 0x6, 0x2, 0xff, 0x4000, 0x0, 0x3, 0xb, 0x9, 0xc060da9, 0x8, 0xfffffffc, 0x0, 0x0, 0x1, 0x6, 0x9, 0x10, 0xa2, 0x2, 0xfffffffc, 0x10, 0x5, 0x4, 0x7392, 0x1, 0x2, 0x6, 0x6, 0x4, 0x9, 0xb1e2, 0x2, 0x1, 0xff, 0x6281, 0x5f, 0xc, 0x0, 0x2, 0x0, 0x7, 0xf987, 0xfffffff7, 0x3, 0x8, 0x2, 0x401, 0x6, 0x2, 0xb, 0x80, 0xfffffff7, 0x1, 0xffffad25, 0xa03, 0xff, 0x0, 0x2, 0x4, 0x4, 0x81, 0x4, 0x3, 0xf]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x8, 0xd4e4, 0x40, 0x3, 0x6, 0x64b8, 0x155a, 0x1000, 0x5dd900, 0x7ff, 0x2800000, 0x401, 0x5d, 0x6, 0xffff, 0x6, 0x80, 0x101, 0x3005f5ab, 0x3b7e6b03, 0xfff, 0x5, 0x2, 0x10000, 0xe, 0x8, 0x4, 0x8, 0x2, 0x7fffffff, 0x566, 0xb1, 0x5, 0x0, 0x0, 0x4, 0x81, 0x1, 0x8, 0x10001, 0x3, 0x0, 0x30000, 0x2, 0x0, 0x1, 0x0, 0x2, 0x2, 0x1, 0x0, 0x2, 0x0, 0x5, 0x1, 0x7, 0x1, 0x5, 0x1, 0x1000, 0x9, 0xfffffffb, 0x8, 0x3, 0xc00000, 0x5da, 0xffff7fff, 0x787, 0x7, 0x5, 0x8, 0x6a65, 0x1, 0x0, 0x5, 0xd6, 0x9, 0x6, 0x3, 0xa, 0xa0b0, 0xffffff81, 0x3ff, 0x1ff, 0xfffffff6, 0xa, 0xf, 0x6, 0x6, 0x7fffffff, 0x3, 0x10000, 0x31a2, 0x10000, 0x9, 0x5d86a571, 0x101, 0x8, 0x9, 0x1, 0x3, 0x2, 0x3, 0xa361, 0x4, 0xfffffff8, 0x80000000, 0x10001, 0xe, 0x2, 0x3d7a3cad, 0xcba, 0x7, 0x8, 0x7, 0x4, 0x800, 0x2, 0x2, 0x7, 0xfffffe00, 0x9, 0xbb7, 0x10, 0x9, 0x1, 0x5, 0x0, 0xff, 0xf, 0x45f, 0x7, 0x6, 0x9, 0x3, 0x7, 0x9, 0xfffffc01, 0x1b9, 0x1ff, 0x10000, 0x2, 0x8, 0xf, 0x5, 0x2, 0x3, 0xecd4, 0xd7, 0x7, 0x6, 0x7, 0x5, 0x7, 0x4, 0x78ad195f, 0x2, 0x6, 0xc, 0x1, 0x7, 0x76, 0xffffffff, 0x4, 0x8, 0x3, 0x7, 0x4, 0x400, 0x5, 0x0, 0x7, 0x2, 0xff, 0xbcdc, 0x40, 0x5, 0x5, 0x2, 0x9, 0x1, 0x2, 0x6, 0x3, 0x39f6, 0xfff, 0x40, 0x5, 0xbf, 0xe8, 0x7fff, 0x2, 0x8, 0x10000, 0x80000001, 0x5, 0x3, 0xc7, 0x7ff, 0x0, 0xfffffff9, 0x3, 0xd23, 0x4, 0x66, 0x2, 0xffffffff, 0x6, 0x9, 0x5, 0x4, 0x8, 0x7, 0xd, 0x7, 0x9, 0x2, 0x5, 0xffffffd4, 0x0, 0xfff, 0x0, 0x6, 0x200, 0x0, 0x0, 0x2, 0x0, 0x7f, 0xfffff801, 0x8, 0x4, 0x9, 0x3, 0x9, 0x2, 0x0, 0xfff, 0x800, 0x9, 0x40, 0x5, 0xfffffffb, 0x8, 0x799, 0x4, 0x3, 0x9, 0x80, 0x3, 0x4, 0x7f, 0x0, 0x4, 0x57]}]]}, {0x4}, {0xc, 0x3, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x112c}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000001780)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x0, 0x0, 0x45}, @l2cap_cid_signaling={{0x41}, [@l2cap_conn_req={{0x2, 0x3, 0x4}, {0xfff, 0xffff}}, @l2cap_conf_req={{0x4, 0x8, 0xc}, {0x0, 0x75cb, [@l2cap_conf_ews={0x7, 0x2, 0x5}, @l2cap_conf_ews={0x7, 0x2, 0x9d5}]}}, @l2cap_conf_rsp={{0x5, 0x3, 0x11}, {0x8000, 0xb59, 0x0, [@l2cap_conf_ews={0x7, 0x2, 0x30}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_flushto={0x2, 0x2, 0x4}]}}, @l2cap_create_chan_rsp={{0xd, 0x3, 0x8}, {0x3, 0x37f5, 0xe9, 0x5}}, @l2cap_disconn_req={{0x6, 0xc, 0x4}, {0x7, 0x1}}]}}, 0x4a) flock(0xffffffffffffffff, 0x2) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x80) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000003010101000000001646741400000000"], 0x14}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x10}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x80) sendmsg(r0, &(0x7f0000000540)={&(0x7f0000000040)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-twofish-avx\x00'}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000300)="80ba9fe37fe15a4003faed2aa9e3563d271030df15105f522e579c6c6290bec90b4f8210a0f02e15b44b489261f66f7b55590ab6b57c91bdfaddcdd76da1e17c1ebd1e6fe8d347d26d9c22ca75fd4066debe5346f9f1de6ca20ded2e2265a6fe8a9d3311508e0033abbbc5dce4fd4276b6c2af72fae05562868f55a38d65bfbe0a81875ed4d0fc68df802cae8bdf976328000b906deb7ff649363e341a34c8903dbefef1cd63a4286405f603e1d0030aa2b26c16d22f0187b6dc372249d5a70f1640e3f1736951", 0xc7}, {&(0x7f0000000400)="d0b60c8e4f23a541b142399ff1171fa464f6ae93c7", 0x15}, {&(0x7f0000000440)="e9a382cb415c427737332b8793744a6be8d7063a063237bcf02ffe0958161a027232e909508c526f5c29b0100731cea6caf22ab49719088c2e23b01798773e78c866f04dfe7a527ff46ce7ae8ce7270e7781918b961b75bbb891fca4d623a9a3e44ce3ed334a95add657e440a499931b6b362c0f1822b33bc546bab04a2c5de7d9e2579627b52afa2674f1006f0fa1eddc61d85163c02964c7f1adc2afef586ebcecd72c22bf894a35299b24ae1d8ac4d64986987490912196780ef837", 0xbd}], 0x3}, 0x1) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 1: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) wait4(r0, 0x0, 0x8, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x38, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) mknod$loop(0x0, 0x6000, 0x1) mknod$loop(&(0x7f00000003c0)='./file1\x00', 0x6000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) io_uring_setup(0x17b1, &(0x7f0000000100)={0x0, 0xe7b5, 0x80, 0x20011, 0x1}) r4 = syz_usb_connect_ath9k(0x3, 0x6e, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0xb, &(0x7f0000000040)=@conn_svc_rsp={0x0, 0x0, 0xa, "2046a2fc", {0x3, 0x1, 0x0, 0x5, 0x1f, 0xf8, 0x5}}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e, 0x2}, 0x18, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) landlock_restrict_self(r5, 0xe) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010005fba2a0070000000000000000000", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00000000000a0002000180c2000003000014001400776c616e3100"/48], 0x48}}, 0x800) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'veth0_virt_wifi\x00', @multicast}) r7 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) dup(0xffffffffffffffff) executing program 2: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 3: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7021000", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r6, 0x104, 0x2) getdents64(r6, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 3: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x4001af84, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000380)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='0', 0x1) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x4048aecb, &(0x7f0000000300)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write$P9_RSTATu(r7, &(0x7f0000000000)=ANY=[], 0x1e) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 0: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 26, 29, 23, 24, 3, 30, 30] detailed listing: executing program 2: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 3: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r4, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7021000", @ANYRES8=r2, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r3, r1, 0x3, &(0x7f0000000140)=[r4, 0xffffffffffffffff, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x10000) close(r5) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0xa) fchdir(r5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r6, 0x104, 0x2) getdents64(r6, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 3: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x4001af84, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000380)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/options/context-info\x00', 0x1, 0x0) write(r4, &(0x7f0000000140)='0', 0x1) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r3, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x4048aecb, &(0x7f0000000300)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write$P9_RSTATu(r7, &(0x7f0000000000)=ANY=[], 0x1e) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) executing program 3: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x1001, 0x8008008) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x5, 0x3}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200)={0x0, 0x8}, 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x1c8080, 0x81) lseek(r7, 0x104, 0x2) getdents64(r7, 0x0, 0x4f) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0800000000000000000000000000000200000505000100070000004704379bdd46fd34a2fdb4ab"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) setrlimit(0xa, &(0x7f0000000300)={0x80000000, 0x1}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0x401, 0x4002, 0x25dfdbff, {0x0, 0x0, 0xffff, 0x0, 0x1d188}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0x6a, 0x1, {0x6, 0x9}}]}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x3c0, 0x76, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x0, 0x1}, {}, {}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x2, 0x1, 0xc}) socket$nl_generic(0x10, 0x3, 0x10) executing program 0: socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x0, 0x202000000100, 0x40000004, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x20, 0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @local}, &(0x7f0000000500)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r5 = fcntl$dupfd(r4, 0x406, r4) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x11, 0x0}, 0xff31) r7 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000000400)={r8, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0xfffffffffffffffd, 0x2]}}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc01c5869, &(0x7f0000000700)={r2, &(0x7f0000000600)='\x89\'\x80/\x00', 0x20103, &(0x7f0000000640)={@_ha_fsid={[0xfee3, 0x1]}, {0xff, 0x4, 0x2, 0x3}}, 0x8, &(0x7f0000000680), &(0x7f0000000180)=0xfff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x19, &(0x7f0000000880)=ANY=[@ANYBLOB="18110000", @ANYRES64=r1, @ANYBLOB="0000000000000000b7020000000000008500000086000000186100000400000000000000f8ffffff852000000300c3e7ad52f52ad7660000b7080000000000007b8af8ff00000000b7080000d80d00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70210000800000018230000", @ANYRES8=r3, @ANYBLOB="0000000000000000b70500000800000085000100a50000008520000004000000a75b0000fcffffff186100000129a0a24978372500000000000000310b00008500000042000000"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', r3, @cgroup_sysctl, r0, 0x8, &(0x7f0000000540)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x5, 0x10001}, 0x10, r6, r1, 0x3, &(0x7f0000000140)=[r8, r9, r0, r1, r0, r1, r1], &(0x7f0000000780)=[{0x0, 0x5, 0x8, 0x3}, {0x4, 0x1, 0x4, 0x61a8a9cee2f380e9}, {0x3, 0x20005, 0x4, 0x9}], 0x10, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r10 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r11 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r10, r11, 0x0, 0x10000) close(r10) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-open-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: 1 programs left: executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-open-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: concatenation succeeded found reproducer with 23 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-open-mmap detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-open-syz_open_dev$dvb_frontend detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-timerfd_gettime-syz_open_dev$dvb_frontend detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) timerfd_gettime(r0, &(0x7f00000001c0)) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-ioctl$KDGETKEYCODE-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000180)={0x800009, 0x10006}) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$tty1-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_usb_connect-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-mkdirat-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xe) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-fcntl$lock-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-timer_create-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-mount-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000480)='addr=127.0.0.1,vers=2,proto=udp\x00') fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./rpc_pipe\x00', &(0x7f0000000240)='rpc_pipefs\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mkdirat-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mkdirat-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mkdirat-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-iopl-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) iopl(0x3) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KFENCE: use-after-free read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, &(0x7f0000000340)='nfs\x00', 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, &(0x7f0000000540)='addr=127.0.0.1E\xa7T.8\x13.m83\xa1&\xed,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=udp\x10\xc5\xec^\x92|\x0e\r\a\xb3\fNe\xfbBo^\xaf\xf7+\xe7I.A\xfdg\xec\xb5\t\xa3+\xd9c\x803\x93\"a\xd1\x02_\xa8#\xec\xe8\xda\xf5\xe4Yr\x8b\xac\xc0\xd0\xf1Y\xa7\xd4\x95\x90\xf7\xd6') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KFENCE: use-after-free read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(0x0, 0x0, 0x40002) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine validation run: crashed=false testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash validation run: crashed=false testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', 0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true reproducing took 43m54.707737447s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff888000c54618 by task syz.0.19/5924 CPU: 1 UID: 0 PID: 5924 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:947 vfs_open+0x82/0x3f0 fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x2873/0x4280 fs/namei.c:4863 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_compat_sys_openat fs/open.c:1436 [inline] __se_compat_sys_openat fs/open.c:1434 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x14b/0x720 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71b74eb Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000fff56a3c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000fff56b00 RDX: 0000000000040002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x11d/0x700 init/main.c:1347 do_initcall_level init/main.c:1409 [inline] do_initcalls init/main.c:1425 [inline] do_basic_setup init/main.c:1445 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658 kernel_init+0x1f/0x1e0 init/main.c:1548 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5923: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline] dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:947 vfs_open+0x82/0x3f0 fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x2873/0x4280 fs/namei.c:4863 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_compat_sys_openat fs/open.c:1436 [inline] __se_compat_sys_openat fs/open.c:1434 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x14b/0x720 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 The buggy address belongs to the object at ffff888000c54600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff888000c54600, ffff888000c54700) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc54 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x7ff00000000040(head|node=0|zone=0|lastcpupid=0x7ff) page_type: f5(slab) raw: 007ff00000000040 ffff88801bc42b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 007ff00000000040 ffff88801bc42b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 007ff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12448522100, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747 driver_register+0x1e2/0x360 drivers/base/driver.c:174 i2c_i801_init drivers/i2c/busses/i2c-i801.c:1761 [inline] i801_driver_init+0x13f/0x180 drivers/i2c/busses/i2c-i801.c:1769 do_one_initcall+0x11d/0x700 init/main.c:1347 do_initcall_level init/main.c:1409 [inline] do_initcalls init/main.c:1425 [inline] do_basic_setup init/main.c:1445 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658 kernel_init+0x1f/0x1e0 init/main.c:1548 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff888000c54500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888000c54580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888000c54600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888000c54680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888000c54700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 56 push %rsi 2: 53 push %rbx 3: 8b 44 24 14 mov 0x14(%rsp),%eax 7: f6 00 08 testb $0x8,(%rax) a: 75 23 jne 0x2f c: 8b 44 24 18 mov 0x18(%rsp),%eax 10: 8b 5c 24 1c mov 0x1c(%rsp),%ebx 14: 8b 4c 24 20 mov 0x20(%rsp),%ecx 18: 8b 54 24 24 mov 0x24(%rsp),%edx 1c: 8b 74 24 28 mov 0x28(%rsp),%esi 20: 8b 7c 24 2c mov 0x2c(%rsp),%edi 24: 8b 6c 24 30 mov 0x30(%rsp),%ebp 28: cd 80 int $0x80 * 2a: 5b pop %rbx <-- trapping instruction 2b: 5e pop %rsi 2c: 5f pop %rdi 2d: 5d pop %rbp 2e: c3 ret 2f: 5b pop %rbx 30: 5e pop %rsi 31: 5f pop %rdi 32: 5d pop %rbp 33: e9 f7 a1 ff ff jmp 0xffffa22f 38: 66 90 xchg %ax,%ax 3a: 66 90 xchg %ax,%ax 3c: 66 90 xchg %ax,%ax 3e: 90 nop 3f: 53 push %rbx final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff888000c54618 by task syz.0.19/5924 CPU: 1 UID: 0 PID: 5924 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 dvb_device_open+0x33f/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:947 vfs_open+0x82/0x3f0 fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x2873/0x4280 fs/namei.c:4863 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_compat_sys_openat fs/open.c:1436 [inline] __se_compat_sys_openat fs/open.c:1434 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x14b/0x720 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71b74eb Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000fff56a3c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000fff56b00 RDX: 0000000000040002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x552/0x820 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0x106/0x1d0 drivers/base/platform.c:1439 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763 driver_register+0x1e2/0x360 drivers/base/driver.c:174 vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x11d/0x700 init/main.c:1347 do_initcall_level init/main.c:1409 [inline] do_initcalls init/main.c:1425 [inline] do_basic_setup init/main.c:1445 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658 kernel_init+0x1f/0x1e0 init/main.c:1548 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5923: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629 dvb_device_put drivers/media/dvb-core/dvbdev.c:628 [inline] dvb_device_open+0x2ba/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6ab/0x14d0 fs/open.c:947 vfs_open+0x82/0x3f0 fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x2873/0x4280 fs/namei.c:4863 do_file_open+0x20e/0x430 fs/namei.c:4892 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_compat_sys_openat fs/open.c:1436 [inline] __se_compat_sys_openat fs/open.c:1434 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x14b/0x720 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 The buggy address belongs to the object at ffff888000c54600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff888000c54600, ffff888000c54700) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc54 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x7ff00000000040(head|node=0|zone=0|lastcpupid=0x7ff) page_type: f5(slab) raw: 007ff00000000040 ffff88801bc42b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 007ff00000000040 ffff88801bc42b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 007ff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 12448522100, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] bus_add_driver+0x92/0x5b0 drivers/base/bus.c:747 driver_register+0x1e2/0x360 drivers/base/driver.c:174 i2c_i801_init drivers/i2c/busses/i2c-i801.c:1761 [inline] i801_driver_init+0x13f/0x180 drivers/i2c/busses/i2c-i801.c:1769 do_one_initcall+0x11d/0x700 init/main.c:1347 do_initcall_level init/main.c:1409 [inline] do_initcalls init/main.c:1425 [inline] do_basic_setup init/main.c:1445 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658 kernel_init+0x1f/0x1e0 init/main.c:1548 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff888000c54500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888000c54580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888000c54600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888000c54680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888000c54700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 56 push %rsi 2: 53 push %rbx 3: 8b 44 24 14 mov 0x14(%rsp),%eax 7: f6 00 08 testb $0x8,(%rax) a: 75 23 jne 0x2f c: 8b 44 24 18 mov 0x18(%rsp),%eax 10: 8b 5c 24 1c mov 0x1c(%rsp),%ebx 14: 8b 4c 24 20 mov 0x20(%rsp),%ecx 18: 8b 54 24 24 mov 0x24(%rsp),%edx 1c: 8b 74 24 28 mov 0x28(%rsp),%esi 20: 8b 7c 24 2c mov 0x2c(%rsp),%edi 24: 8b 6c 24 30 mov 0x30(%rsp),%ebp 28: cd 80 int $0x80 * 2a: 5b pop %rbx <-- trapping instruction 2b: 5e pop %rsi 2c: 5f pop %rdi 2d: 5d pop %rbp 2e: c3 ret 2f: 5b pop %rbx 30: 5e pop %rsi 31: 5f pop %rdi 32: 5d pop %rbp 33: e9 f7 a1 ff ff jmp 0xffffa22f 38: 66 90 xchg %ax,%ax 3a: 66 90 xchg %ax,%ax 3c: 66 90 xchg %ax,%ax 3e: 90 nop 3f: 53 push %rbx