Extracting prog: 19m2.343018394s Minimizing prog: 8m24.717070567s Simplifying prog options: 0s Extracting C: 43.742573996s Simplifying C: 2m49.453323328s extracting reproducer from 44 programs testing a last program of every proc single: executing 9 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socketpair$unix-sendmmsg-gettid-timer_create-bpf$PROG_LOAD-socket$nl_audit-syz_mount_image$ext4-capset-syz_open_dev$tty1-openat-quotactl_fd$Q_QUOTAOFF-bind$netlink-socket$nl_audit-socket$nl_netfilter-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_open_dev$evdev-syz_mount_image$ext4-ioctl$EVIOCSFF-write$char_usb-bind$netlink-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-bpf$BPF_PROG_TEST_RUN-fcntl$lock-mprotect-timer_settime-bpf$BPF_PROG_ATTACH detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-socket$inet6_tcp-setsockopt$IP6T_SO_SET_REPLACE-syz_open_dev$tty1-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getrusage-ioctl$TIOCL_SETSEL-socket-sendmsg$nl_netfilter detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ppp-fsconfig$FSCONFIG_CMD_CREATE-fsmount-ioctl$PPPIOCSMAXCID-syz_open_procfs-sendmsg$AUDIT_USER_TTY-syz_usb_connect$cdc_ncm detailed listing: executing program 0: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-setsockopt$inet6_tcp_int-prlimit64-close-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-recvmmsg-symlink-unshare-socket$nl_route-sendmsg$nl_route-sendmsg$nl_route-unlink-timer_create-timer_settime-syz_init_net_socket$nfc_llcp-dup-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_GET_PROG_INFO-timer_gettime detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-fcntl$lock-prlimit64-sched_setscheduler-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-openat$ttyS3-openat$procfs-recvmmsg-openat$ttyS3-readv-openat$uinput-ioctl$UI_ABS_SETUP-write$uinput_user_dev-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range detailed listing: executing program 0: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r3, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r4, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs_ctrl-fcntl$lock-timer_create-fcntl$lock-mprotect-utime-timer_settime-mmap-openat$cgroup_ro-write$binfmt_script-mmap-socketpair$nbd-ioctl$sock_SIOCETHTOOL-syz_mount_image$vfat-mknodat$loop-socket$nl_generic-sendmsg$TIPC_NL_BEARER_ENABLE-madvise-socket$xdp-mlock-mmap$IORING_OFF_SQ_RING-ioctl$BINDER_CTL_ADD detailed listing: executing program 0: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000e00)='./binderfs/binder-control\x00', 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x200}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) utime(0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x1b, "5c76276f6c86622447099377e66e2ebe9d615061f3ca96d0407044"}}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000001440)={[{@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@uni_xlate}, {@uni_xlateno}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@utf8}, {@shortname_mixed}, {@utf8no}, {@utf8}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@numtail}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socket$xdp(0x2c, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs_ctrl-fcntl$lock-timer_create-fcntl$lock-mprotect-utime-timer_settime-mmap-openat$cgroup_ro-write$binfmt_script-mmap-socketpair$nbd-ioctl$sock_SIOCETHTOOL-syz_mount_image$vfat-mknodat$loop-socket$nl_generic-sendmsg$TIPC_NL_BEARER_ENABLE-madvise-socket$xdp-mlock-mmap$IORING_OFF_SQ_RING-ioctl$BINDER_CTL_ADD detailed listing: executing program 0: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000e00)='./binderfs/binder-control\x00', 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x200}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) utime(0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x1b, "5c76276f6c86622447099377e66e2ebe9d615061f3ca96d0407044"}}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000001440)={[{@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@uni_xlate}, {@uni_xlateno}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@utf8}, {@shortname_mixed}, {@utf8no}, {@utf8}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@numtail}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socket$xdp(0x2c, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-socket$inet_tcp-bind$inet-socket$inet6_tcp-setsockopt$inet6_int-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd2-ioctl$VHOST_SET_VRING_KICK-setsockopt$sock_int-bind$inet6-listen-llistxattr-unlinkat detailed listing: executing program 0: r0 = syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000340)='./file2\x00', 0x2010000, &(0x7f0000000200)=ANY=[], 0x41, 0x251, &(0x7f0000000b80)="$eJzsmb9rFEEUx7+zv+4uilil0EYwYES9y+0VpjnUgGBlk/ir0sOsId4mJ3creAtigo0W2lkINhb+AxYBU1nY2VkJWqggCHqghY3NyuzMzs3eXTZmD6u8TzH57ry3M++9mX1FDgRB7Fq+fP796dHc7MJxAHsxhYKc/2YCjAltaP4fn94+9qR+9tnLDy/erO67uzm4Hn8litITxbRLymwBeH3GxD21kzL/4WJKPizAUPoCDByV+hIYylJfg4GLUntguCL3v5loAC3uXy7fWPa98vWWv8jFDB+qfHD5UMNAfL11hkUVfBTJssAG0OmGzYbve21NWNLOZ07OpUy5hAqmOTl0fjYc9A4CdS0+XsXLD+6v8+ekNjOqfu9QhYGfMokaGOalzywKSW1ESbT8D1j4nqxvavuLKJNsU3FzV27YLsmiEPVfI31Q3HnVHHjtTqkfYXwhlA8/tux1pnk6p4dN+5HnFJF+y0bfZMrAsDbO/ci8OrGwhk9nUJyS5cqx1/lUeTPEY34m/ylTXeTKIhGTvc23+syhbmjD/6pmnJHffBixbVd+NfHv96eY6eP0E8RDeW65Uy4hbBrjVCxko3YH3m+I/hE9Zzii9SdL6x+VYOVWpdMNTyyvNJa8JW/VdWuFPcIWN6JKPA71vX5/LsX9aUJb397C1zEc3GkEQbsqRoc5KCEI2m787GqfzfxG68dV+VqAcwAOiwfeNh21ouiEBW0PU/oY8V+ups0tgycIgiAIgiAIgiAIgiAIgtgJyT9XoywYsCZ+nvkbAAD//07yWUk=") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e22, 0x3, @remote, 0x6}, 0x1c) listen(r2, 0x70000008) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file2\x00', 0x200) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-socket$inet_tcp-bind$inet-socket$inet6_tcp-setsockopt$inet6_int-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd2-ioctl$VHOST_SET_VRING_KICK-setsockopt$sock_int-bind$inet6-listen-llistxattr-unlinkat detailed listing: executing program 0: r0 = syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000340)='./file2\x00', 0x2010000, &(0x7f0000000200)=ANY=[], 0x41, 0x251, &(0x7f0000000b80)="$eJzsmb9rFEEUx7+zv+4uilil0EYwYES9y+0VpjnUgGBlk/ir0sOsId4mJ3creAtigo0W2lkINhb+AxYBU1nY2VkJWqggCHqghY3NyuzMzs3eXTZmD6u8TzH57ry3M++9mX1FDgRB7Fq+fP796dHc7MJxAHsxhYKc/2YCjAltaP4fn94+9qR+9tnLDy/erO67uzm4Hn8litITxbRLymwBeH3GxD21kzL/4WJKPizAUPoCDByV+hIYylJfg4GLUntguCL3v5loAC3uXy7fWPa98vWWv8jFDB+qfHD5UMNAfL11hkUVfBTJssAG0OmGzYbve21NWNLOZ07OpUy5hAqmOTl0fjYc9A4CdS0+XsXLD+6v8+ekNjOqfu9QhYGfMokaGOalzywKSW1ESbT8D1j4nqxvavuLKJNsU3FzV27YLsmiEPVfI31Q3HnVHHjtTqkfYXwhlA8/tux1pnk6p4dN+5HnFJF+y0bfZMrAsDbO/ci8OrGwhk9nUJyS5cqx1/lUeTPEY34m/ylTXeTKIhGTvc23+syhbmjD/6pmnJHffBixbVd+NfHv96eY6eP0E8RDeW65Uy4hbBrjVCxko3YH3m+I/hE9Zzii9SdL6x+VYOVWpdMNTyyvNJa8JW/VdWuFPcIWN6JKPA71vX5/LsX9aUJb397C1zEc3GkEQbsqRoc5KCEI2m787GqfzfxG68dV+VqAcwAOiwfeNh21ouiEBW0PU/oY8V+ups0tgycIgiAIgiAIgiAIgiAIgtgJyT9XoywYsCZ+nvkbAAD//07yWUk=") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e22, 0x3, @remote, 0x6}, 0x1c) listen(r2, 0x70000008) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file2\x00', 0x200) program did not crash single: failed to extract reproducer bisect: bisecting 44 programs with base timeout 30s testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 26, 26, 30, 13, 14, 14, 9, 17, 6, 7, 5, 22, 22, 19, 4, 3, 28, 17, 24, 23, 25, 23, 18, 8, 4, 19, 28, 20, 8, 30, 30, 26, 23, 27, 3, 7, 23, 20, 26, 7, 8, 18, 28] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000003c0)={0x0, 0x0}, 0x8) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x44}}, 0x0) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300)=r3, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000004940)={r4, 0x20, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}}, 0x10) fcntl$lock(r2, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x400005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x3, 0x40}, 0x42) connect$netlink(0xffffffffffffffff, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x25dfdbfb, 0x20}, 0xc) write(0xffffffffffffffff, &(0x7f0000000000)='\"', 0x1) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) ioctl$BTRFS_IOC_QUOTA_CTL(r0, 0xc0109428, &(0x7f00000000c0)={0x2, 0x19}) listen(r0, 0x0) socket$unix(0x1, 0x1, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$ITER_CREATE(0x22, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x5) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r5, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r5, 0x0) executing program 4: mknodat$null(0xffffffffffffff9c, 0x0, 0x1d4e, 0x103) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file2\x00', 0x8, &(0x7f0000000080)={[{@nodioread_nolock}, {@sb={'sb', 0x3d, 0x1}}]}, 0x4, 0x523, &(0x7f00000018c0)="$eJzs3cFvG1kZAPBvnLhJs+mmC3sABGxZFgqq6iTubrTqhfYCQlUlRMWJQxsSN4pi11Hsiib0kB65V6ISJ+A/4MYBqScO3LjBjUs5IBWoQA0SB6MZT1I3sZNAnbiJfz9pMvPeTP29F/e953mR5wUwtC5ExGZEnImIOxExlecn+RbX2lt63csXDxe2XjxcSKLVuvX3JDuf5kXHv0m9k7/meER8/zsRP0r2xm2sb6zMV6uVtTw93aytTjfWNy4vF/Kc8tzs3MynVz4p962uH9R+/fzbyzd+8NvffOnZHza/+ZO0WJM/PZed66xHP7WrXozJjrzRiLhxFMEGZDT//8PJk7a2z0TEh1n7n4qR7N0EAE6zVmsqWlOdaQDgtEvv/ycjKZTyuYDJKBRKpfYc3vsxUajWG81LU/X79xYjm8M6H8XC3eVqZSafKzwfxSRNz2bHr9Ll19KPK1ci4r2IeDx2NjtfWqhXFwf5wQcAhtg7u8b/f421x/9OxUEVDgA4OuODLgAAcOyM/wAwfIz/ADB8/ofx37cDAeCUcP8PAMPH+A8Aw+fA8f/R8ZQDADgW37t5M91aW+3nX28/qfvyYqWxUqrdXygt1NdWS0v1+lK1UlpotQ56vWq9vjr78U6ysb5xu1a/f695e7k2v1S5XfEsAQAYvPc+ePqndNDfvHo226JjLQdjNZxuhUEXABiYkUEXABgY3+eB4XWIe3zTAHDKdVmity2fIEh6XfDE4q9wUl38vPl/GFZvMv9v7gBOtv9v/v9bfS8HcPyM4TC8Wq3Emv8AMGTM8QM9//6f6/mIkCf9LwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcFJPZlhRK2Vrgm+nPQqkUcS4izkcxubtcrcxExLsR8cex4lianh10oQGAN1T4a5Kv/3Vx6qPJ3WfPJP8ey/YR8eOf3/rZg/lmc202zf/HTn7zSZp/trlWPjOICgAAna7tzcrG73K+77iRf/ni4cL2dpxFfH69vbhoGncr39pnRmM0249HMSIm/pnk6bb088pIH+JvPoqIz23XfzwedESYzOZA2iuf7o6fxj7X9/idv//d8Quv1beQnUv3xex38dnYVTjgQE+vt/vJvO2lTTxvf4W4kO27t//xrId6c2n/lzbXrT39X2Gn/xvZEz/J2vyFnfT+JXn+8e++uyezNdU+9yjiC6Pd4ic78ZPu/W/xo0PW8c9f/PKHvc61fhFxsWv9t1ekrmXd7HSztjrdWN+4vFybX6osVe6Vy3OzczOfXvmkPJ3NUbd//r5bjL9dvfRur/hp/Sd6xB/fv/7xtUPW/5f/ufPDr+wT/xtf7f7+v79P/HRM/Poh489PXOu5fHcaf7FH/Q94/+PSIeM/+8vG4iEvBQCOQWN9Y2W+Wq2sHXCQftY86BoHhz9I7+3fgmJkB7EZ0a8XzCYlIqLrNekn6rejykd1kAws+q/6/YKD7pmAo/aq0Q+6JAAAAAAAAAAAAAAAQC+N9Y2Vse7f1urbwaDrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn13wAAAP//KHnENg==") socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="120000007f0000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r3, &(0x7f0000000500), 0x0}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) nanosleep(&(0x7f0000000000)={0x77359400}, 0x0) syz_clone3(&(0x7f000000dd80)={0xa46500, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000ec0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f74656f64653d30303030303030303030303030303030303036303030302c75736572643dfc1ba26864132ab0adf8b66e1e480c26a68999350cb61ce1a5beae6b6410558a89b8005b97ba5455d84c83731d5ac3707f93eb1dff91ea4dd77ef32ade0e68acc9f2337ce91cabcc743781c45b1871ee85d8af955404287baedf8666263843df7d4e2753f5ef878424490e6081928accba33977c7317e6cb", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000001040)={[{@resgid={'resgid', 0x3d, 0xee00}}, {@nojournal_checksum}, {@grpquota}, {@noauto_da_alloc}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@nogrpid}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@quota}, {@noauto_da_alloc}]}, 0x3, 0x572, &(0x7f00000006c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000240)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) unshare(0x40400) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000080)={0xfffc, 0x6}, 0x4) setsockopt$sock_int(r4, 0x1, 0x2c, &(0x7f0000000e00)=0x8000408, 0x4b) setsockopt$packet_fanout_data(r4, 0x107, 0x16, 0x0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file0/..\x00', &(0x7f0000000300)={0x41c902, 0xa6, 0x9}, 0x18) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) r6 = syz_mount_image$fuse(&(0x7f0000000400), &(0x7f0000000480)='./file0/file0/..\x00', 0x80008, &(0x7f0000001100)=ANY=[@ANYBLOB, @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB=',max_read=0x0000000000000005,default_permissions,max_read=0x000000000000aa50,blksize=0x0000000000001000,max_read=0x0000000000000007,blksize=0x0000000000001200,default_permissions,allow_other,blksize=0x0000000000003e00,uid<', @ANYRESDEC=0xee01, @ANYBLOB="2c736d63636b66736465663d6f21402525eb86682d3c75", @ANYRESDEC, @ANYRES16=r4], 0x1, 0x0, 0x0) clock_gettime(0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) r7 = inotify_init() inotify_add_watch(r7, &(0x7f0000000080)='./file0\x00', 0x800) r8 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) read$FUSE(r8, 0x0, 0x0) utimensat(r6, 0x0, 0x0, 0x100) ioctl$FS_IOC_FSGETXATTR(r5, 0x801c581f, 0x0) executing program 4: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'syz_tun\x00', &(0x7f0000000000)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, [0xfffffffc]}}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bind$vsock_stream(r2, 0x0, 0x0) futex(&(0x7f0000004000), 0x5, 0x0, 0x0, &(0x7f0000004000), 0x82020000) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="84000000640400012abd7000fddbdf2528f97a675ff94597553eae4e10202a953c0e4295a44d84fd6cc7db108eb7499a9cb33a69905e0aa51083b0db4a7b15fbeef1acfb8d43b48cff64c074726eb6194ee07b05830be4143327c3e4579330877e039503b396a4e22632e32f65581fa4ab1271ff41537e902a754853db3100431ceeec21456dfdbcc5d58bd8040eb3c84795fd33db9d633644c3"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) executing program 4: r0 = syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000340)='./file2\x00', 0x2010000, &(0x7f0000000200)=ANY=[], 0x41, 0x251, &(0x7f0000000b80)="$eJzsmb9rFEEUx7+zv+4uilil0EYwYES9y+0VpjnUgGBlk/ir0sOsId4mJ3creAtigo0W2lkINhb+AxYBU1nY2VkJWqggCHqghY3NyuzMzs3eXTZmD6u8TzH57ry3M++9mX1FDgRB7Fq+fP796dHc7MJxAHsxhYKc/2YCjAltaP4fn94+9qR+9tnLDy/erO67uzm4Hn8litITxbRLymwBeH3GxD21kzL/4WJKPizAUPoCDByV+hIYylJfg4GLUntguCL3v5loAC3uXy7fWPa98vWWv8jFDB+qfHD5UMNAfL11hkUVfBTJssAG0OmGzYbve21NWNLOZ07OpUy5hAqmOTl0fjYc9A4CdS0+XsXLD+6v8+ekNjOqfu9QhYGfMokaGOalzywKSW1ESbT8D1j4nqxvavuLKJNsU3FzV27YLsmiEPVfI31Q3HnVHHjtTqkfYXwhlA8/tux1pnk6p4dN+5HnFJF+y0bfZMrAsDbO/ci8OrGwhk9nUJyS5cqx1/lUeTPEY34m/ylTXeTKIhGTvc23+syhbmjD/6pmnJHffBixbVd+NfHv96eY6eP0E8RDeW65Uy4hbBrjVCxko3YH3m+I/hE9Zzii9SdL6x+VYOVWpdMNTyyvNJa8JW/VdWuFPcIWN6JKPA71vX5/LsX9aUJb397C1zEc3GkEQbsqRoc5KCEI2m787GqfzfxG68dV+VqAcwAOiwfeNh21ouiEBW0PU/oY8V+ups0tgycIgiAIgiAIgiAIgiAIgtgJyT9XoywYsCZ+nvkbAAD//07yWUk=") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e22, 0x3, @remote, 0x6}, 0x1c) listen(r2, 0x70000008) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file2\x00', 0x200) executing program 32: r0 = syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000340)='./file2\x00', 0x2010000, &(0x7f0000000200)=ANY=[], 0x41, 0x251, &(0x7f0000000b80)="$eJzsmb9rFEEUx7+zv+4uilil0EYwYES9y+0VpjnUgGBlk/ir0sOsId4mJ3creAtigo0W2lkINhb+AxYBU1nY2VkJWqggCHqghY3NyuzMzs3eXTZmD6u8TzH57ry3M++9mX1FDgRB7Fq+fP796dHc7MJxAHsxhYKc/2YCjAltaP4fn94+9qR+9tnLDy/erO67uzm4Hn8litITxbRLymwBeH3GxD21kzL/4WJKPizAUPoCDByV+hIYylJfg4GLUntguCL3v5loAC3uXy7fWPa98vWWv8jFDB+qfHD5UMNAfL11hkUVfBTJssAG0OmGzYbve21NWNLOZ07OpUy5hAqmOTl0fjYc9A4CdS0+XsXLD+6v8+ekNjOqfu9QhYGfMokaGOalzywKSW1ESbT8D1j4nqxvavuLKJNsU3FzV27YLsmiEPVfI31Q3HnVHHjtTqkfYXwhlA8/tux1pnk6p4dN+5HnFJF+y0bfZMrAsDbO/ci8OrGwhk9nUJyS5cqx1/lUeTPEY34m/ylTXeTKIhGTvc23+syhbmjD/6pmnJHffBixbVd+NfHv96eY6eP0E8RDeW65Uy4hbBrjVCxko3YH3m+I/hE9Zzii9SdL6x+VYOVWpdMNTyyvNJa8JW/VdWuFPcIWN6JKPA71vX5/LsX9aUJb397C1zEc3GkEQbsqRoc5KCEI2m787GqfzfxG68dV+VqAcwAOiwfeNh21ouiEBW0PU/oY8V+ups0tgycIgiAIgiAIgiAIgiAIgtgJyT9XoywYsCZ+nvkbAAD//07yWUk=") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e22, 0x3, @remote, 0x6}, 0x1c) listen(r2, 0x70000008) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file2\x00', 0x200) executing program 3: r0 = syz_socket_connect_nvme_tcp() mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002540)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x1000}}) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x8004, 0x0, 0x81, 0xffffffff}) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2092) write$FUSE_INIT(r1, &(0x7f00000022c0)={0x50, 0x0, r2, {0x7, 0x9, 0x0, 0x2321810, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100}}, 0x50) sendto$inet_nvme_pdu(r0, &(0x7f00000001c0)=@data_h2c={{}, 0x0, 0x0, 0x1, 0x0, "cfbf3586"}, 0x80, 0x0, 0x0, 0x0) close(r0) executing program 3: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x1071814, &(0x7f0000000080), 0x7, 0x521, &(0x7f0000000640)="$eJzs3d9rK1kdAPDvTJtue2/XZlXkuuDu4q7cu+hN2q2rVWR3BdGnBXV9v9Y2LaVpU5p0vS2LdvEPEERU8A/wRfDBR0H2TxDhgr6LiiJ6rz7qHZlkqv2RtLFNm2v6+cBpzsmZOd9zhmaSmTnMBHBtvRARb0TEWES8HBEzxftpkWK/k/LlHj18ZylPSWTZW39NIineO2grL49HxM1itcmI+OqXIr6RnIzb3N1bX6zXa9tFudra2Ko2d/furm0srtZWa5vz83M/j4hXF2azwoXGWY6I177wxx989ydffO2Xn/jm7+79+c638m597kOdfkfE0oUC9NBpu9TeFgfybbR9GcGGJB9PaWzYvQAAoB/5b/z3R8RH27//Z2Ks/WsOAAAAGCXZ69PxzyQiAwAAAEZWGhHTkaSVYi7AdKRppdKZw/vBuJHWG83Wx1caO5vLeV1EOUrpylq9NlvMFS5HKcnLc8Uc24PyK8fK8xHxTER8f2aqXa4sNerLwz75AQAAANfEzeePHv//YyZt5wEAAIARU+5ZAAAAAEaFQ34AAAAYfY7/AQAAYKR9+c0385QdPMd7+e3dnfXG23eXa831ysbOUmWpsb1VWW00Vtv37Ns4q716o7H1ydjcuV9t1ZqtanN3795GY2ezdW/tyCOwAQAAgCv0zPPv/TaJiP3PTrVTFPcBBDjiD8PuADBIY8PuADA048PuADA0pTOXsIeAUZecUX9y8k7nXGH86nL6AwAADN7tD5+8/j9R1J19bgD4f2auDwBcP0ev7k0NrR/A1SuddwbgrUH3BBiW93VenupV3/PmHX1c/++cY8iyc3UMAAAYmOl2StJKcQwwHWlaqUQ8HY+zcpSSlbV6bbao+81M6am8PNdeMzlzzjAAAAAAAAAAAAAAAAAAAAAAAAAA0JFlSWQAAADASItI/5S07+YfcXvmpemjZweOPfXrx2/98P5iq7U9FzGR/G0mf2siIlo/Kt5/JfNIAAAAABiuqfxP5zi9eJ0bdpcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDWPHr6zdJCuMu5fPh8R5W7xx2Oy/ToZpYi48fckxg+tl0TE2ADi778bEbe6xU/icZZl5aIX3eJPXXL8cnvTdI+fRsTNAcSH6+y9fP/zRrfPXxovtF+7f/7Gi3RRvfd/6X/2f2M99j9PHyv38uyDn1V7xn834tnx7vufg/hJJ/6REHnhxT7H+PWv7e11rTjUZLf4h2NVWxtb1ebu3t21jcXV2mptc35+7lMLn154dWG2urJWrxV/u4b53kd+8fi08d/oEb98dPwntv9LfY0+i389uP/wA51CqVv8Oy92//691SN+Wnz3fazI5/W3D/L7nfxhz/3018+dNv7lHuOfPGP8d/oaf3zm5a985/dda05sDQDgKjR399YX6/Xa9imZyT6W+Z8yERdt5/WB9udJyMTZy0w+IV29jEz27c7/48XaueDqJzLZRVYfjwF0Y+LE53QszttgErGft9XnPyQAADBi/vuj/7QrSAAAAAAAAAAAAAAAAAAAAMBlOudtySYjou+Fj8fcH85QAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO9e8AAAD//zDU0hs=") (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='system.posix_acl_access\x00', &(0x7f0000000e00)={{}, {}, [], {}, [], {0x8}}, 0x24, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3ff, 0x8, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x8031, 0xffffffffffffffff, 0x7d06d000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r1 = syz_open_pts(r0, 0x40000) ioctl$KDENABIO(r1, 0x4b36) (async) epoll_create1(0x0) (async) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000100)={0x7fff, 0xf, 0x100, 0x10001, 0x3ce01e8b, 0x0, 0x10000}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) setuid(0xee01) (async) r3 = signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x6ba]}, 0x8) fremovexattr(r3, &(0x7f0000000200)=@random={'btrfs.', '\x00'}) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xa000004}, 0xc, &(0x7f00000005c0)={&(0x7f0000000240)={0x380, r2, 0x200, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x13}}}}, [@NL80211_ATTR_TX_RATES={0x78, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x74, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xc, 0x5, 0x5970, 0x1ff, 0x3, 0x2, 0x3, 0x5d96]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x6, 0xb, 0x53, 0x3, 0xfffe, 0xe15, 0x7fff]}}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x36, 0x5, 0x4, 0xb, 0x24, 0x30, 0x6c, 0x2, 0x2, 0x2, 0x1, 0xc, 0x6c, 0x5, 0x16, 0x16, 0x1b, 0x12, 0x5, 0x0, 0x3, 0x60, 0x1, 0x16, 0x6, 0x30, 0x2, 0x48, 0x27, 0x18, 0x24, 0x4]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x32, 0x60, 0x16, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x7, 0x1, 0x4, 0x2, 0x7fff, 0x39a7, 0x8]}}]}]}, @NL80211_ATTR_TX_RATES={0x1c0, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x68, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0xf, 0x2, [{0x0, 0x5}, {0x7}, {0x5, 0x3}, {0x7, 0x7}, {0x6, 0xa}, {0x1}, {0x4, 0x2}, {0x7, 0x8}, {0x7}, {0x2, 0x6}, {0x1, 0x5}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x2, 0x89, 0x3, 0x1, 0xfff8, 0x9a2d, 0xfffa]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x2f, 0x2, [{0x6, 0x2}, {0x0, 0x6}, {0x6, 0x8}, {0x4, 0x1}, {0x1, 0x3}, {0x2, 0x9}, {0x0, 0x2}, {0x1, 0xa}, {0x4, 0x3}, {0x6, 0x7}, {0x0, 0xa}, {0x3, 0xa}, {0x4, 0x3}, {0x4}, {0x5, 0xa}, {0x7, 0x3}, {0x1, 0x4}, {0x6}, {0x6, 0x7}, {0x2, 0x9}, {0x4}, {0x4, 0x6}, {0x2, 0x5}, {0x5, 0x9}, {0x7, 0x2}, {0x6, 0x2}, {0x5, 0x5}, {0x2, 0x2}, {0x7, 0x1}, {0x2, 0x2}, {0x0, 0x1}, {0x4, 0x9}, {0x2}, {0x2, 0x9}, {0x3, 0xa}, {0x5, 0x4}, {0x0, 0xa}, {0x2, 0x2}, {0x2, 0x8}, {0x1, 0x3}, {0x7, 0x8}, {0x1, 0x6}, {0x4}]}]}, @NL80211_BAND_60GHZ={0x68, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0xd, 0x1, [0x1b, 0xc, 0x4, 0x3, 0x6c, 0x24, 0x5, 0x2, 0x30]}, @NL80211_TXRATE_HT={0x4b, 0x2, [{0x3, 0x5}, {0x7, 0x2}, {0x1, 0x4}, {0x1, 0xa}, {0x1, 0x1}, {0x2, 0x3}, {0x6, 0x7}, {0x0, 0x8}, {0x3, 0x7}, {0x4, 0x7}, {0x2, 0xa}, {0x1, 0x8}, {0x6, 0x9}, {0x6}, {0x5, 0x1}, {0x6, 0x9}, {0x6, 0x8}, {0x1, 0x5}, {0x6, 0x6}, {0x5, 0x4}, {0x3, 0x8}, {0x0, 0x6}, {0x1, 0x6}, {0x2, 0x4}, {0x4, 0x5}, {0x6, 0x3}, {0x6, 0x7}, {0x7, 0x1}, {0x6, 0x8}, {0x1}, {0x0, 0x9}, {0x1, 0x8}, {0x0, 0x3}, {0x2, 0x8}, {0x6, 0x8}, {0x5, 0x5}, {0x4, 0x2}, {0x0, 0x1}, {0x0, 0x2}, {0x4}, {0x2, 0x7}, {0x4, 0x6}, {0x0, 0x6}, {0x3, 0x5}, {0x6, 0x2}, {0x5, 0x3}, {0x6}, {0x2, 0x1}, {0x7, 0x2}, {0x0, 0x2}, {0x0, 0x3}, {0x0, 0x1}, {0x2, 0x8}, {0x7, 0xa}, {0x2, 0x3}, {0x2, 0x2}, {0x2, 0x4}, {}, {0x1, 0x2}, {0x0, 0x4}, {0x1, 0x1}, {0x4, 0x4}, {0x1, 0xa}, {0x3}, {0x6, 0x8}, {0x7, 0x9}, {0x7, 0x3}, {0x0, 0x1}, {0x7}, {0x4, 0x1}, {0x0, 0x4}]}]}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x27f, 0x7, 0x8, 0x401, 0xc, 0x5, 0x2]}}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0xb, 0x1b, 0x1b, 0xb]}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x3, 0x60, 0x9, 0x1, 0x60, 0x9, 0xb, 0x12, 0x12, 0x30, 0x9, 0x2, 0xb, 0x6, 0x30, 0x1b, 0x2, 0x1b, 0x4, 0x5, 0x6c, 0x2, 0x36, 0x4, 0x3]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x60e8, 0x5, 0x7, 0x2, 0x0, 0x5]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x5, 0x6, 0x825f, 0x4, 0x4, 0x3, 0x4]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x0, 0x8, 0x69b5, 0xf, 0x10, 0x4, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x3, 0x80, 0x3, 0x2, 0xc4c, 0x4c, 0x8]}}]}, @NL80211_BAND_6GHZ={0x4}, @NL80211_BAND_60GHZ={0x20, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6, 0x9, 0x9, 0x8, 0x7, 0x1, 0x8]}}]}, @NL80211_BAND_60GHZ={0x1c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0x128, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0xc4, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x9, 0x2, 0x803f, 0x0, 0x7, 0x2, 0x467]}}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x24, 0x4, 0x9, 0x16, 0x5]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x400, 0x1ff, 0x6, 0x8000, 0x7f, 0x101, 0x3a]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x4ce1, 0x3, 0x9, 0x58ff, 0x4, 0x9, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x43, 0x2, [{0x1, 0x9}, {0x7, 0x3}, {0x4, 0x7}, {0x6, 0x1}, {0x7, 0x6}, {0x7, 0x3}, {0x4, 0x3}, {0x7, 0x1}, {0x4, 0x6}, {0x5, 0x2}, {0x7, 0x8}, {0x1}, {0x0, 0x5}, {0x4, 0x9}, {0x0, 0x8}, {0x0, 0x5}, {0x4, 0x9}, {0x7}, {0x6, 0x4}, {0x6, 0x8}, {0x1, 0x5}, {0x7, 0x5}, {0x1, 0x8}, {0x5, 0x2}, {0x0, 0x7}, {0x7, 0x4}, {0x1, 0x7}, {0x5}, {0x3, 0x7}, {0x4, 0x5}, {0x1}, {0x1, 0x1}, {0x4, 0x8}, {0x4, 0x9}, {0x0, 0x2}, {0x4, 0x1}, {0x2, 0x4}, {0x4, 0x8}, {0x5, 0x4}, {0x1, 0x8}, {0x0, 0xa}, {0x0, 0x3}, {0x1, 0x6}, {0x0, 0x4}, {0x0, 0x2}, {0x4, 0x8}, {}, {0x2, 0x8}, {0x3, 0x4}, {0x7, 0x6}, {0x5, 0x2}, {0x0, 0x5}, {0x1, 0x2}, {0x0, 0x9}, {0x1, 0x8}, {0x7, 0xa}, {0x1, 0x6}, {0x6, 0x9}, {0x3, 0x1}, {0x5, 0x4}, {0x2, 0x7}, {0x0, 0x5}, {0x0, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x4, 0x1, 0x0, 0x2, 0x8, 0x7, 0x401]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x60, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x78d, 0x3, 0x7, 0x1, 0x4, 0x3e5, 0xf, 0xb]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x401, 0xf, 0x9, 0xff01, 0x1, 0x7f, 0x80, 0xb]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0xffff, 0x8, 0x5, 0x8000, 0x1, 0x0, 0x8]}}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0xb, 0x3, 0xc, 0x36, 0x3, 0x6c, 0x3, 0x71, 0x60, 0x24, 0xc, 0x1, 0x12, 0x16, 0x36, 0x6c, 0x12, 0x6, 0x3, 0x16, 0x1, 0x2, 0x2, 0x4, 0x1, 0x30, 0x16, 0x6c]}]}]}]}, 0x380}}, 0x4000800) (async) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x0, 0x1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) read$eventfd(r1, &(0x7f0000000300), 0x8) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000100)="569534ab1bbe0e", 0x7}], 0x1) executing program 3: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)=ANY=[@ANYBLOB="4c000000059b284300000000000000000a00001038000a803400028006000340000000001400018008000100ac1e010108000200e000592b0001140001800800010064010102080002007f00"], 0x4c}, 0x1, 0x0, 0x0, 0x40810}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@mblk_io_submit}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000680)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) executing program 3: syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x80, 0xe0, 0x7, {0x8, 0xb, 0x9, 0x1, 0x1, 0xa}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x3, 0x9, 0xc5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0x4, 0x0, {0x8, 0x25, 0x1, 0x3, 0x9, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x5, 0x4, 0x2, {0x8, 0x25, 0x1, 0x83, 0x0, 0xa, 0x2}}}}}}}}]}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@mcast1, @private=0xa010101, 0x54, 0xb}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x7800, 0x7000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @private=0x10000}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000140)={'gre0\x00', r1, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast1, @broadcast}}}}) executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000e00)='./binderfs/binder-control\x00', 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x200}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) utime(0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x1b, "5c76276f6c86622447099377e66e2ebe9d615061f3ca96d0407044"}}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000001440)={[{@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@uni_xlate}, {@uni_xlateno}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@utf8}, {@shortname_mixed}, {@utf8no}, {@utf8}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@numtail}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socket$xdp(0x2c, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, 0x0) executing program 33: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000e00)='./binderfs/binder-control\x00', 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x200}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) utime(0x0, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x1b, "5c76276f6c86622447099377e66e2ebe9d615061f3ca96d0407044"}}) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000001440)={[{@shortname_mixed}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@uni_xlate}, {@uni_xlateno}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@utf8}, {@shortname_mixed}, {@utf8no}, {@utf8}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@numtail}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socket$xdp(0x2c, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, 0x0) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) unshare(0x62040200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r3, 0x0) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x30, 0x14, 0x509, 0x70bd2c, 0xfffffffd, {0x2, 0x18}, [@IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_ADDRESS={0x8, 0x1, @local}, @IFA_BROADCAST={0x8, 0x4, @multicast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@delneigh={0x30, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1, 0x0, 0x0, 0x4}, [@NDA_LLADDR={0xa, 0x2, @broadcast}, @NDA_VLAN={0x6, 0x5, 0x4}]}, 0x30}, 0x7ffffffe, 0x0, 0x0, 0x8000}, 0x4000000) executing program 6: openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}}, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_setup(0x9, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r0, 0x0}]) socket$inet6_udp(0xa, 0x2, 0x0) close(0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000640)={0x0, 0x0, 0x1d, 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f0000000240)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8000, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="290000000600000000000000000012d4277c8375b55684c6308de94f0000010000000000000007000000000000002b000000000000000096cc6e92957a681db8e8c0ae64e01147d5811f368f1dcf16295dd32e2240f28c62ce486c"], 0x29) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC=r1], 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) futex(&(0x7f0000000040)=0x2, 0xc, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x1, 0x2) bind$inet6(r4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xb, 0x4, 0x7fff0000}]}) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_emit_ethernet(0x68, &(0x7f0000000340)=ANY=[@ANYBLOB="bb1c9995dfaa866acc00000086dd6002adf700323a00fe880000000000000000000000000001ff020000000000000000000000000001020090780000000060fd906300002b000000000000000000000000000000000100000000000000000000d600000000011e52"], 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x50, 0x0, 0x0, 0x8000}, {0x20, 0x0, 0x2, 0xfffff038}, {0x6, 0xfc, 0x0, 0x4}]}, 0x10) mount$9p_tcp(0x0, &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=tcp', @ANYRES64=r5, @ANYRES32=r3, @ANYRESHEX=r4, @ANYRES16=r4]) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000000)) executing program 5: r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x4a, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2000003ffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24344bfb1403e75160122fd3817165b1af109e63bf1f6cb68e8a92a6d710ddad451b6b938345f46fead32c840a37fe3b5a8706195c8bf0f7aff3ea48b729d9efce5c327387a625d2d4f34c55aadf03ee8769f596a6733225778e1f6ce33662b4671873c22d6a4f61ad8bf633f0a7432827ab37167bfa2817af69bf5d1e8b2ae2ec213cc5a66da2be61d121b85bc88e915abc15d6d1021ac6adfe4820859d69f466bd7331756b465e4488bed8fd9f2b1f9da7bb6ad2f6d06487bd9ead90ca86699ef3563ab274a5abb5c62d4c2b2999e3f6c63d77bb2c6529d68769976c8d05cc97", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5102000790780003"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0xd000, 0x4, 0xe, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0x7, 0x4f}, {0x0, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x2, 0x2, 0x0, 0x24, 0x1, 0x5, 0x0, 0xc4, 0x5}, {0xd000, 0x2000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0xa000, 0x9, 0x1, 0x8, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x8000000, 0xb, 0x0, 0x3, 0x1, 0x1, 0xc3, 0x4, 0x90, 0x1, 0xfc}, {0x70000, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x5, 0x7, 0x80, 0xf8}, {0xf7f63004, 0x1, 0xf, 0x5, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x5}, {0x80a0000, 0x9}, 0x4001000e, 0x0, 0xffff1000, 0x300, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x7, 0xc5]}) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f0000000640)) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffb, 0x0, 0xffd}}}}}}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) (async) syz_emit_ethernet(0x4a, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2000003ffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24344bfb1403e75160122fd3817165b1af109e63bf1f6cb68e8a92a6d710ddad451b6b938345f46fead32c840a37fe3b5a8706195c8bf0f7aff3ea48b729d9efce5c327387a625d2d4f34c55aadf03ee8769f596a6733225778e1f6ce33662b4671873c22d6a4f61ad8bf633f0a7432827ab37167bfa2817af69bf5d1e8b2ae2ec213cc5a66da2be61d121b85bc88e915abc15d6d1021ac6adfe4820859d69f466bd7331756b465e4488bed8fd9f2b1f9da7bb6ad2f6d06487bd9ead90ca86699ef3563ab274a5abb5c62d4c2b2999e3f6c63d77bb2c6529d68769976c8d05cc97", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5102000790780003"], 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0xd000, 0x4, 0xe, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0x7, 0x4f}, {0x0, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x2, 0x2, 0x0, 0x24, 0x1, 0x5, 0x0, 0xc4, 0x5}, {0xd000, 0x2000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0xa000, 0x9, 0x1, 0x8, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x8000000, 0xb, 0x0, 0x3, 0x1, 0x1, 0xc3, 0x4, 0x90, 0x1, 0xfc}, {0x70000, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x5, 0x7, 0x80, 0xf8}, {0xf7f63004, 0x1, 0xf, 0x5, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x5}, {0x80a0000, 0x9}, 0x4001000e, 0x0, 0xffff1000, 0x300, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x7, 0xc5]}) (async) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f0000000640)) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffb, 0x0, 0xffd}}}}}}}, 0x0) (async) executing program 6: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r4, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r5, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) dup(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_gettime(r5, 0x0) executing program 2: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000002440)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8c}, 0x1c, 0x0}}], 0x1, 0x80) userfaultfd(0x801) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000600)=""/128, 0x80}], 0x1, 0x111, 0x0) r6 = socket(0x10, 0x2, 0x0) write(r6, &(0x7f0000000480)="1c0000001a009b8a140000003b000000000000000000000000000000fda35065733173ae72a0d270d958f739b6d44c893b03599f77a332b446ea93568ae2ff534952656c6a18b6c0fdcec321127e", 0x4e) recvmmsg(r6, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x3000) sendfile(0xffffffffffffffff, r1, &(0x7f0000000100)=0x4, 0x6) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x1000, 0xdddd1000, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0xff}, {0x200000, 0x3000, 0x3, 0x10, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x0, 0x9, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0xf, 0xa, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x9, 0x3, 0x3, 0x6, 0xab, 0x80, 0x7, 0x2, 0xdb, 0xfc}, {0x60000, 0x100000, 0xc, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x3, 0x2}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x406e, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x30, 0x14, 0x509, 0x70bd2c, 0xfffffffd, {0x2, 0x18, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_ADDRESS={0x8, 0x1, @local}, @IFA_BROADCAST={0x8, 0x4, @multicast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) unshare(0x62040200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 6: openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}}, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_setup(0x9, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r0, 0x0}]) socket$inet6_udp(0xa, 0x2, 0x0) close(0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000640)={0x0, 0x0, 0x1d, 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f0000000240)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8000, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="290000000600000000000000000012d4277c8375b55684c6308de94f0000010000000000000007000000000000002b000000000000000096cc6e92957a681db8e8c0ae64e01147d5811f368f1dcf16295dd32e2240f28c62ce486c"], 0x29) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC=r1], 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) futex(&(0x7f0000000040)=0x2, 0xc, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x1, 0x2) bind$inet6(r4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xb, 0x4, 0x7fff0000}]}) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x1000006, 0x800) io_setup(0x3ff, &(0x7f0000000500)=0x0) r3 = epoll_create1(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000000)={0x80000000}) io_submit(r2, 0x1, &(0x7f0000000440)=[&(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x200, r1, 0x0, 0x0, 0x4, 0x0, 0x1, r1}]) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x35ca}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r3 = socket(0xa, 0x800, 0x7) sendto(r3, &(0x7f00000003c0)="e1118ce4769b", 0xfdef, 0x800, &(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7, @local, 0x5}, 0x80) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0x2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_vs\x00') read$eventfd(r4, &(0x7f0000000100), 0x8) mount$9p_fd(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="ecb00700000000"], 0x1c}}, 0xea5bc50b6199d77e) r6 = socket$inet6_udp(0xa, 0x2, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0xf6902, 0x0) chdir(0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000580)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6tnl0\x00', 0x0, 0x4, 0xc9, 0x9, 0x3, 0x4e, @local, @loopback, 0x10, 0x1, 0x40, 0xe}}) r7 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) pwritev(r7, &(0x7f0000000440), 0x0, 0x7, 0x1ff) setpriority(0x0, r0, 0x3a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0x3fe, &(0x7f00000001c0)) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x0, 0x0, 0x0) r1 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="5d963ec4e6ea6c02f6c3a2be62c1441de86bc65ef417a9a2d744056a49658399ee91338e93ff220c328a54cbe01565133a207360e40ff3333bfa3ef53960c5803c17c6368465cad30197f0fe35391f6972d2", 0x52, 0xfffffffffffffffd) r2 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$search(0xa, r1, &(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x2}, r2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x1) r4 = openat(0xffffffffffffff9c, 0x0, 0x204141, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) set_robust_list(0x0, 0x0) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="75bb000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000000000280012800b00010062726964676500001800028005002c00020000000c002e000100000001000000"], 0x48}}, 0x0) fallocate(r4, 0x0, 0x9, 0x8ffff) read$FUSE(r3, &(0x7f00000014c0)={0x2020}, 0xffffff64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmsg$nl_route(r8, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x11420400}, 0xc, &(0x7f0000000700)={&(0x7f0000000780)=ANY=[@ANYBLOB="6c010000197000fedbdf251d0143da96e96c010008000000c6ef4b46c79814c247a6aaf6cf8496440f4e0490503dd8287f4f79d52b9368e4abf06c4bdf73acb82c1e2d021e25bcfe920f2d2b69f306000000000000000043073917bd0673418091e1f8fc7a5a2d0000819720981edbf4dd9a3ccd584002eeecc02e09770b3f10da130f4116f303", @ANYRES32=0x0, @ANYBLOB="150001000000000003010000d3c26214f53bba23010000001e0106005d36167e00177778a4c34a7c0da5c0ac45150d017d54811f9d25cd6ab52bbbfed4c838d62b7a10f76908e9255c485bdbb67bb63455a9ed75ceffad5963cf9c5d971e95061e7176c6c1af32d58e15c30db04ab4e0c3889191f9ce27e983fc77ded6e85d8c5983363c1fb52c9cd62017a2d22035bfe2cf7753f071d7768691ba0913435bc89973c05da05db66af83772bac52d5ec6b28b1253d3820360034cde59669f89adae4a7c14e1f5b2147cbdf8f9208a7bd4dba5414b547aedc9ff8d6b105a5e757ccc5495f31a594954883b6cb75885492536e9547d3c26a998a466e17aef66e1779ed42776bba75743bbb8e58869575a2de854939a1846809dd29b7a6fe9f6f8749701cad45fb76dfd77570a0fa162077f892348e5e0d8000008000a00", @ANYRES32=0x0, @ANYBLOB="05000d0001000000"], 0x164}, 0x1, 0x0, 0x0, 0x440c5}, 0x1) ioctl$FS_IOC_SETFLAGS(r9, 0x40086602, &(0x7f0000000300)=0x8) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x505, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) gettid() r0 = io_uring_setup(0x6c0c, &(0x7f0000000000)={0x0, 0x451b, 0x0, 0x3, 0x119}) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000dc0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2208086, &(0x7f00000007c0), 0xff, 0x4a9, &(0x7f0000000cc0)="$eJzs3MuLHEUcAODfzL7zXB9R81DXFwYf2WTzMAcPKgoeFAQ9RG/rZjes2RjJrmBCcKNIPErAu3gU/As86UXUk+BVT14kEGRBEo1gS/d073NmMrOZ3Ul2vg9mqaqu7a7q6uqpru6eADrWUPqnFLElIn5Nw+UsOi/JM6X5rs2dH/t77vxYKZLk9T9L2bKrc+fHirzF/23JI3vLEeVPSrG7ynanz547OTo1NX4mjw/PnHpvePrsuacnT42eGD8x/u7I0aOHDh545sjI4ZbUc2ta1l0fnt6z8+U3L706duzS2z9+3V2UdVk9WmUohpbsy8Uea/XG2mzronCpu40FoSldEZE2V0/W/7dHVyw03vZ46eO2Fg5YU0mSJNtqL76QABtYKdpdAqA9ii/6q3MD0b9G18G3sivPVy6A0npfyz+VJd1RzvP0LLu+baX+bKpkduDYhX++iGz/93XU/gcA1t+36fjnqcr4p/hUlgzGPYvyPZfNB6epEXdExJ0RcVdE3B0ROyKyvPdGxH1Nbn9oWXzl+LN8eVUVa1A6/ns2v7e1dPyXj/7+Swa78tjWGIjB6ClNTE6N74+IbRGxN3r6JianBupt47sXf/lsScLc1fmBd1r/dOxXfNLtF2PBvByXu/uWru/46MxoK+qeuvJRNgc4u7L+C3eu0tDOiNi1ivWn4+bJJ77aU2v5jetfRwvuMyVfRjxeaf8LUaf+y+9PFg1+ZOTwcH9Mje8fnujJLhSq+Onni6/V2v5N1b8F0vbfVPX4n6//YGnx/drpha7RqIu/fVrzmqaJ4/+tIiU9/ntLb2Th3jztg9GZmTMHInpLr6xMH1lYWxEv8l/ZsiPiker9Pz3HpcdYWv/dEZEexPdHxAMR8WBe9oci4uHIVlHN7LWI+OGFR99ZTf2b3M2rkrb/8SXtHzdo/+YDXSe//yZdUbWTZGPtfygL7c1TGjn/NVrAm91/AAAAcDsoZ8/Al8r75sPl8r59EZuzud1N5anT0zNPTpx+//rxyrPyg9FTLuY/K/PBlfnQA/nccBEfWRY/mM8bf941kMU35fe+gfbZvLj/ZxOOlf6f+qOrzYUD1p73taBzLfT/Wq+rrlD3gQfg9uH7HzpXE/3fqQI2mPlO3Vc/X7IOZQHWV7Uv9dk2lANYf901wsDGp89D59L/oXPp/9CRbua9/tUESg2/mb8BArPVd+/vtf+rP+qtsPcWqVcWiHIWSGbbWIx/88fQGsp8Pf/JyzUoT/HgXJ7yV+3MxU/E3AotWD/QvnMSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAK/0fAAD///gF41o=") prlimit64(0x0, 0x2, &(0x7f0000001e40)={0x0, 0x400}, 0x0) r3 = socket(0x1e, 0xc, 0x0) accept4$inet6(r3, &(0x7f0000000800)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000840)=0x1c, 0x80800) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4006, r4, 0x0}]) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000002c0), 0x1) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(r4) open$dir(0x0, 0x10000, 0x104) executing program 6: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r3, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r4, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100"/52, @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./file1\x00', 0x183042, 0x15) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file1'}}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff010}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x2}]}, 0x10) sendmmsg$inet(r6, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000010101"], 0x44}}, 0x4000) recvmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2180, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000100)=0x4, 0x6) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x1000, 0xdddd1000, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0xff}, {0x200000, 0x3000, 0x3, 0x10, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x0, 0x9, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0xf, 0xa, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x9, 0x3, 0x3, 0x6, 0xab, 0x80, 0x7, 0x2, 0xdb, 0xfc}, {0x60000, 0x100000, 0xc, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x3, 0x2}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x406e, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) executing program 0: timerfd_settime(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$rtc(0xffffff9c, &(0x7f0000000080), 0xa200, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0) close(0x3) syz_usb_connect$uac1(0x2, 0x72, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0x240400, 0x81) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000140)={@private=0xa010101, @multicast1, @remote}, 0xc) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r1, 0xaea3) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f00000004c0)={0x1, 0x0, @pic={0xff, 0x2, 0x4, 0x1, 0xff, 0x9, 0x2, 0x81, 0x17, 0x5, 0x10, 0xf9, 0x9, 0xf, 0x7, 0x4}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x103900, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0x80a0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0xcf, 0x0, 0x0, 0x42a1, 0x80a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x1, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 1: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work bisect: bisecting 44 programs bisect: split chunks (needed=false): <44> bisect: split chunk #0 of len 44 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 28, 17, 24, 23, 25, 23, 18, 8, 4, 19, 28, 20, 8, 30, 30, 26, 23, 27, 3, 7, 23, 20, 26, 7, 8, 18, 28] detailed listing: executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x30, 0x14, 0x509, 0x70bd2c, 0xfffffffd, {0x2, 0x18}, [@IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_ADDRESS={0x8, 0x1, @local}, @IFA_BROADCAST={0x8, 0x4, @multicast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@delneigh={0x30, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1, 0x0, 0x0, 0x4}, [@NDA_LLADDR={0xa, 0x2, @broadcast}, @NDA_VLAN={0x6, 0x5, 0x4}]}, 0x30}, 0x7ffffffe, 0x0, 0x0, 0x8000}, 0x4000000) executing program 6: openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}}, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_setup(0x9, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r0, 0x0}]) socket$inet6_udp(0xa, 0x2, 0x0) close(0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000640)={0x0, 0x0, 0x1d, 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f0000000240)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8000, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="290000000600000000000000000012d4277c8375b55684c6308de94f0000010000000000000007000000000000002b000000000000000096cc6e92957a681db8e8c0ae64e01147d5811f368f1dcf16295dd32e2240f28c62ce486c"], 0x29) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC=r1], 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) futex(&(0x7f0000000040)=0x2, 0xc, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x1, 0x2) bind$inet6(r4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xb, 0x4, 0x7fff0000}]}) executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_emit_ethernet(0x68, &(0x7f0000000340)=ANY=[@ANYBLOB="bb1c9995dfaa866acc00000086dd6002adf700323a00fe880000000000000000000000000001ff020000000000000000000000000001020090780000000060fd906300002b000000000000000000000000000000000100000000000000000000d600000000011e52"], 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x50, 0x0, 0x0, 0x8000}, {0x20, 0x0, 0x2, 0xfffff038}, {0x6, 0xfc, 0x0, 0x4}]}, 0x10) mount$9p_tcp(0x0, &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=tcp', @ANYRES64=r5, @ANYRES32=r3, @ANYRESHEX=r4, @ANYRES16=r4]) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000000)) executing program 5: r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x4a, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2000003ffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24344bfb1403e75160122fd3817165b1af109e63bf1f6cb68e8a92a6d710ddad451b6b938345f46fead32c840a37fe3b5a8706195c8bf0f7aff3ea48b729d9efce5c327387a625d2d4f34c55aadf03ee8769f596a6733225778e1f6ce33662b4671873c22d6a4f61ad8bf633f0a7432827ab37167bfa2817af69bf5d1e8b2ae2ec213cc5a66da2be61d121b85bc88e915abc15d6d1021ac6adfe4820859d69f466bd7331756b465e4488bed8fd9f2b1f9da7bb6ad2f6d06487bd9ead90ca86699ef3563ab274a5abb5c62d4c2b2999e3f6c63d77bb2c6529d68769976c8d05cc97", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5102000790780003"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0xd000, 0x4, 0xe, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0x7, 0x4f}, {0x0, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x2, 0x2, 0x0, 0x24, 0x1, 0x5, 0x0, 0xc4, 0x5}, {0xd000, 0x2000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0xa000, 0x9, 0x1, 0x8, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x8000000, 0xb, 0x0, 0x3, 0x1, 0x1, 0xc3, 0x4, 0x90, 0x1, 0xfc}, {0x70000, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x5, 0x7, 0x80, 0xf8}, {0xf7f63004, 0x1, 0xf, 0x5, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x5}, {0x80a0000, 0x9}, 0x4001000e, 0x0, 0xffff1000, 0x300, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x7, 0xc5]}) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f0000000640)) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffb, 0x0, 0xffd}}}}}}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) (async) syz_emit_ethernet(0x4a, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2000003ffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24344bfb1403e75160122fd3817165b1af109e63bf1f6cb68e8a92a6d710ddad451b6b938345f46fead32c840a37fe3b5a8706195c8bf0f7aff3ea48b729d9efce5c327387a625d2d4f34c55aadf03ee8769f596a6733225778e1f6ce33662b4671873c22d6a4f61ad8bf633f0a7432827ab37167bfa2817af69bf5d1e8b2ae2ec213cc5a66da2be61d121b85bc88e915abc15d6d1021ac6adfe4820859d69f466bd7331756b465e4488bed8fd9f2b1f9da7bb6ad2f6d06487bd9ead90ca86699ef3563ab274a5abb5c62d4c2b2999e3f6c63d77bb2c6529d68769976c8d05cc97", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5102000790780003"], 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0xd000, 0x4, 0xe, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0x7, 0x4f}, {0x0, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x2, 0x2, 0x0, 0x24, 0x1, 0x5, 0x0, 0xc4, 0x5}, {0xd000, 0x2000, 0x4, 0xf8, 0x3, 0x68, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0xa000, 0x9, 0x1, 0x8, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x8000000, 0xb, 0x0, 0x3, 0x1, 0x1, 0xc3, 0x4, 0x90, 0x1, 0xfc}, {0x70000, 0x4000, 0xf, 0xff, 0x3, 0xfb, 0x0, 0xb, 0x5, 0x7, 0x80, 0xf8}, {0xf7f63004, 0x1, 0xf, 0x5, 0xfc, 0x3, 0xa, 0x1, 0x54, 0x1, 0xff, 0x5}, {0xeeef0000, 0x5}, {0x80a0000, 0x9}, 0x4001000e, 0x0, 0xffff1000, 0x300, 0x5, 0x2100, 0xe6e70c00, [0x3, 0x20000401, 0x7, 0xc5]}) (async) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f0000000640)) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xfffb, 0x0, 0xffd}}}}}}}, 0x0) (async) executing program 6: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r4, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r5, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) dup(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_gettime(r5, 0x0) executing program 2: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000002440)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8c}, 0x1c, 0x0}}], 0x1, 0x80) userfaultfd(0x801) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000600)=""/128, 0x80}], 0x1, 0x111, 0x0) r6 = socket(0x10, 0x2, 0x0) write(r6, &(0x7f0000000480)="1c0000001a009b8a140000003b000000000000000000000000000000fda35065733173ae72a0d270d958f739b6d44c893b03599f77a332b446ea93568ae2ff534952656c6a18b6c0fdcec321127e", 0x4e) recvmmsg(r6, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x3000) sendfile(0xffffffffffffffff, r1, &(0x7f0000000100)=0x4, 0x6) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x1000, 0xdddd1000, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0xff}, {0x200000, 0x3000, 0x3, 0x10, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x0, 0x9, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0xf, 0xa, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x9, 0x3, 0x3, 0x6, 0xab, 0x80, 0x7, 0x2, 0xdb, 0xfc}, {0x60000, 0x100000, 0xc, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x3, 0x2}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x406e, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x30, 0x14, 0x509, 0x70bd2c, 0xfffffffd, {0x2, 0x18, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_ADDRESS={0x8, 0x1, @local}, @IFA_BROADCAST={0x8, 0x4, @multicast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) unshare(0x62040200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 6: openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}}, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_setup(0x9, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r0, 0x0}]) socket$inet6_udp(0xa, 0x2, 0x0) close(0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000640)={0x0, 0x0, 0x1d, 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f0000000240)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8000, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="290000000600000000000000000012d4277c8375b55684c6308de94f0000010000000000000007000000000000002b000000000000000096cc6e92957a681db8e8c0ae64e01147d5811f368f1dcf16295dd32e2240f28c62ce486c"], 0x29) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYRESDEC=r1], 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) futex(&(0x7f0000000040)=0x2, 0xc, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x1, 0x2) bind$inet6(r4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xb, 0x4, 0x7fff0000}]}) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 1: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x1000006, 0x800) io_setup(0x3ff, &(0x7f0000000500)=0x0) r3 = epoll_create1(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000000)={0x80000000}) io_submit(r2, 0x1, &(0x7f0000000440)=[&(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x200, r1, 0x0, 0x0, 0x4, 0x0, 0x1, r1}]) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x35ca}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r3 = socket(0xa, 0x800, 0x7) sendto(r3, &(0x7f00000003c0)="e1118ce4769b", 0xfdef, 0x800, &(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7, @local, 0x5}, 0x80) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0x2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_vs\x00') read$eventfd(r4, &(0x7f0000000100), 0x8) mount$9p_fd(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="ecb00700000000"], 0x1c}}, 0xea5bc50b6199d77e) r6 = socket$inet6_udp(0xa, 0x2, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0xf6902, 0x0) chdir(0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000580)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6tnl0\x00', 0x0, 0x4, 0xc9, 0x9, 0x3, 0x4e, @local, @loopback, 0x10, 0x1, 0x40, 0xe}}) r7 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) pwritev(r7, &(0x7f0000000440), 0x0, 0x7, 0x1ff) setpriority(0x0, r0, 0x3a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0x3fe, &(0x7f00000001c0)) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x0, 0x0, 0x0) r1 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="5d963ec4e6ea6c02f6c3a2be62c1441de86bc65ef417a9a2d744056a49658399ee91338e93ff220c328a54cbe01565133a207360e40ff3333bfa3ef53960c5803c17c6368465cad30197f0fe35391f6972d2", 0x52, 0xfffffffffffffffd) r2 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$search(0xa, r1, &(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x2}, r2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x1) r4 = openat(0xffffffffffffff9c, 0x0, 0x204141, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) set_robust_list(0x0, 0x0) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="75bb000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000000000280012800b00010062726964676500001800028005002c00020000000c002e000100000001000000"], 0x48}}, 0x0) fallocate(r4, 0x0, 0x9, 0x8ffff) read$FUSE(r3, &(0x7f00000014c0)={0x2020}, 0xffffff64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmsg$nl_route(r8, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x11420400}, 0xc, &(0x7f0000000700)={&(0x7f0000000780)=ANY=[@ANYBLOB="6c010000197000fedbdf251d0143da96e96c010008000000c6ef4b46c79814c247a6aaf6cf8496440f4e0490503dd8287f4f79d52b9368e4abf06c4bdf73acb82c1e2d021e25bcfe920f2d2b69f306000000000000000043073917bd0673418091e1f8fc7a5a2d0000819720981edbf4dd9a3ccd584002eeecc02e09770b3f10da130f4116f303", @ANYRES32=0x0, @ANYBLOB="150001000000000003010000d3c26214f53bba23010000001e0106005d36167e00177778a4c34a7c0da5c0ac45150d017d54811f9d25cd6ab52bbbfed4c838d62b7a10f76908e9255c485bdbb67bb63455a9ed75ceffad5963cf9c5d971e95061e7176c6c1af32d58e15c30db04ab4e0c3889191f9ce27e983fc77ded6e85d8c5983363c1fb52c9cd62017a2d22035bfe2cf7753f071d7768691ba0913435bc89973c05da05db66af83772bac52d5ec6b28b1253d3820360034cde59669f89adae4a7c14e1f5b2147cbdf8f9208a7bd4dba5414b547aedc9ff8d6b105a5e757ccc5495f31a594954883b6cb75885492536e9547d3c26a998a466e17aef66e1779ed42776bba75743bbb8e58869575a2de854939a1846809dd29b7a6fe9f6f8749701cad45fb76dfd77570a0fa162077f892348e5e0d8000008000a00", @ANYRES32=0x0, @ANYBLOB="05000d0001000000"], 0x164}, 0x1, 0x0, 0x0, 0x440c5}, 0x1) ioctl$FS_IOC_SETFLAGS(r9, 0x40086602, &(0x7f0000000300)=0x8) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x505, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) gettid() r0 = io_uring_setup(0x6c0c, &(0x7f0000000000)={0x0, 0x451b, 0x0, 0x3, 0x119}) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000dc0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2208086, &(0x7f00000007c0), 0xff, 0x4a9, &(0x7f0000000cc0)="$eJzs3MuLHEUcAODfzL7zXB9R81DXFwYf2WTzMAcPKgoeFAQ9RG/rZjes2RjJrmBCcKNIPErAu3gU/As86UXUk+BVT14kEGRBEo1gS/d073NmMrOZ3Ul2vg9mqaqu7a7q6uqpru6eADrWUPqnFLElIn5Nw+UsOi/JM6X5rs2dH/t77vxYKZLk9T9L2bKrc+fHirzF/23JI3vLEeVPSrG7ynanz547OTo1NX4mjw/PnHpvePrsuacnT42eGD8x/u7I0aOHDh545sjI4ZbUc2ta1l0fnt6z8+U3L706duzS2z9+3V2UdVk9WmUohpbsy8Uea/XG2mzronCpu40FoSldEZE2V0/W/7dHVyw03vZ46eO2Fg5YU0mSJNtqL76QABtYKdpdAqA9ii/6q3MD0b9G18G3sivPVy6A0npfyz+VJd1RzvP0LLu+baX+bKpkduDYhX++iGz/93XU/gcA1t+36fjnqcr4p/hUlgzGPYvyPZfNB6epEXdExJ0RcVdE3B0ROyKyvPdGxH1Nbn9oWXzl+LN8eVUVa1A6/ns2v7e1dPyXj/7+Swa78tjWGIjB6ClNTE6N74+IbRGxN3r6JianBupt47sXf/lsScLc1fmBd1r/dOxXfNLtF2PBvByXu/uWru/46MxoK+qeuvJRNgc4u7L+C3eu0tDOiNi1ivWn4+bJJ77aU2v5jetfRwvuMyVfRjxeaf8LUaf+y+9PFg1+ZOTwcH9Mje8fnujJLhSq+Onni6/V2v5N1b8F0vbfVPX4n6//YGnx/drpha7RqIu/fVrzmqaJ4/+tIiU9/ntLb2Th3jztg9GZmTMHInpLr6xMH1lYWxEv8l/ZsiPiker9Pz3HpcdYWv/dEZEexPdHxAMR8WBe9oci4uHIVlHN7LWI+OGFR99ZTf2b3M2rkrb/8SXtHzdo/+YDXSe//yZdUbWTZGPtfygL7c1TGjn/NVrAm91/AAAAcDsoZ8/Al8r75sPl8r59EZuzud1N5anT0zNPTpx+//rxyrPyg9FTLuY/K/PBlfnQA/nccBEfWRY/mM8bf941kMU35fe+gfbZvLj/ZxOOlf6f+qOrzYUD1p73taBzLfT/Wq+rrlD3gQfg9uH7HzpXE/3fqQI2mPlO3Vc/X7IOZQHWV7Uv9dk2lANYf901wsDGp89D59L/oXPp/9CRbua9/tUESg2/mb8BArPVd+/vtf+rP+qtsPcWqVcWiHIWSGbbWIx/88fQGsp8Pf/JyzUoT/HgXJ7yV+3MxU/E3AotWD/QvnMSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAK/0fAAD///gF41o=") prlimit64(0x0, 0x2, &(0x7f0000001e40)={0x0, 0x400}, 0x0) r3 = socket(0x1e, 0xc, 0x0) accept4$inet6(r3, &(0x7f0000000800)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000840)=0x1c, 0x80800) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4006, r4, 0x0}]) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000002c0), 0x1) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(r4) open$dir(0x0, 0x10000, 0x104) executing program 6: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r3, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r4, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100"/52, @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./file1\x00', 0x183042, 0x15) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file1'}}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff010}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x2}]}, 0x10) sendmmsg$inet(r6, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000010101"], 0x44}}, 0x4000) recvmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2180, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000100)=0x4, 0x6) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x1000, 0xdddd1000, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0xff}, {0x200000, 0x3000, 0x3, 0x10, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x0, 0x9, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0xf, 0xa, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x9, 0x3, 0x3, 0x6, 0xab, 0x80, 0x7, 0x2, 0xdb, 0xfc}, {0x60000, 0x100000, 0xc, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x3, 0x2}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x406e, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) executing program 0: timerfd_settime(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$rtc(0xffffff9c, &(0x7f0000000080), 0xa200, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0) close(0x3) syz_usb_connect$uac1(0x2, 0x72, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0x240400, 0x81) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000140)={@private=0xa010101, @multicast1, @remote}, 0xc) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r1, 0xaea3) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f00000004c0)={0x1, 0x0, @pic={0xff, 0x2, 0x4, 0x1, 0xff, 0x9, 0x2, 0x81, 0x17, 0x5, 0x10, 0xf9, 0x9, 0xf, 0x7, 0x4}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x103900, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0x80a0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0xcf, 0x0, 0x0, 0x42a1, 0x80a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x1, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 1: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30, 26, 23, 27, 3, 7, 23, 20, 26, 7, 8, 18, 28] detailed listing: executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x35ca}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r3 = socket(0xa, 0x800, 0x7) sendto(r3, &(0x7f00000003c0)="e1118ce4769b", 0xfdef, 0x800, &(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7, @local, 0x5}, 0x80) ioctl$int_in(r3, 0x5452, &(0x7f0000000100)=0x2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_vs\x00') read$eventfd(r4, &(0x7f0000000100), 0x8) mount$9p_fd(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="ecb00700000000"], 0x1c}}, 0xea5bc50b6199d77e) r6 = socket$inet6_udp(0xa, 0x2, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0xf6902, 0x0) chdir(0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000580)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6tnl0\x00', 0x0, 0x4, 0xc9, 0x9, 0x3, 0x4e, @local, @loopback, 0x10, 0x1, 0x40, 0xe}}) r7 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) pwritev(r7, &(0x7f0000000440), 0x0, 0x7, 0x1ff) setpriority(0x0, r0, 0x3a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0x3fe, &(0x7f00000001c0)) executing program 5: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x0, 0x0, 0x0) r1 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="5d963ec4e6ea6c02f6c3a2be62c1441de86bc65ef417a9a2d744056a49658399ee91338e93ff220c328a54cbe01565133a207360e40ff3333bfa3ef53960c5803c17c6368465cad30197f0fe35391f6972d2", 0x52, 0xfffffffffffffffd) r2 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$search(0xa, r1, &(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x2}, r2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x1) r4 = openat(0xffffffffffffff9c, 0x0, 0x204141, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) set_robust_list(0x0, 0x0) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="75bb000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000000000280012800b00010062726964676500001800028005002c00020000000c002e000100000001000000"], 0x48}}, 0x0) fallocate(r4, 0x0, 0x9, 0x8ffff) read$FUSE(r3, &(0x7f00000014c0)={0x2020}, 0xffffff64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmsg$nl_route(r8, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x11420400}, 0xc, &(0x7f0000000700)={&(0x7f0000000780)=ANY=[@ANYBLOB="6c010000197000fedbdf251d0143da96e96c010008000000c6ef4b46c79814c247a6aaf6cf8496440f4e0490503dd8287f4f79d52b9368e4abf06c4bdf73acb82c1e2d021e25bcfe920f2d2b69f306000000000000000043073917bd0673418091e1f8fc7a5a2d0000819720981edbf4dd9a3ccd584002eeecc02e09770b3f10da130f4116f303", @ANYRES32=0x0, @ANYBLOB="150001000000000003010000d3c26214f53bba23010000001e0106005d36167e00177778a4c34a7c0da5c0ac45150d017d54811f9d25cd6ab52bbbfed4c838d62b7a10f76908e9255c485bdbb67bb63455a9ed75ceffad5963cf9c5d971e95061e7176c6c1af32d58e15c30db04ab4e0c3889191f9ce27e983fc77ded6e85d8c5983363c1fb52c9cd62017a2d22035bfe2cf7753f071d7768691ba0913435bc89973c05da05db66af83772bac52d5ec6b28b1253d3820360034cde59669f89adae4a7c14e1f5b2147cbdf8f9208a7bd4dba5414b547aedc9ff8d6b105a5e757ccc5495f31a594954883b6cb75885492536e9547d3c26a998a466e17aef66e1779ed42776bba75743bbb8e58869575a2de854939a1846809dd29b7a6fe9f6f8749701cad45fb76dfd77570a0fa162077f892348e5e0d8000008000a00", @ANYRES32=0x0, @ANYBLOB="05000d0001000000"], 0x164}, 0x1, 0x0, 0x0, 0x440c5}, 0x1) ioctl$FS_IOC_SETFLAGS(r9, 0x40086602, &(0x7f0000000300)=0x8) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x505, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44040) gettid() r0 = io_uring_setup(0x6c0c, &(0x7f0000000000)={0x0, 0x451b, 0x0, 0x3, 0x119}) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, &(0x7f0000000dc0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2208086, &(0x7f00000007c0), 0xff, 0x4a9, &(0x7f0000000cc0)="$eJzs3MuLHEUcAODfzL7zXB9R81DXFwYf2WTzMAcPKgoeFAQ9RG/rZjes2RjJrmBCcKNIPErAu3gU/As86UXUk+BVT14kEGRBEo1gS/d073NmMrOZ3Ul2vg9mqaqu7a7q6uqpru6eADrWUPqnFLElIn5Nw+UsOi/JM6X5rs2dH/t77vxYKZLk9T9L2bKrc+fHirzF/23JI3vLEeVPSrG7ynanz547OTo1NX4mjw/PnHpvePrsuacnT42eGD8x/u7I0aOHDh545sjI4ZbUc2ta1l0fnt6z8+U3L706duzS2z9+3V2UdVk9WmUohpbsy8Uea/XG2mzronCpu40FoSldEZE2V0/W/7dHVyw03vZ46eO2Fg5YU0mSJNtqL76QABtYKdpdAqA9ii/6q3MD0b9G18G3sivPVy6A0npfyz+VJd1RzvP0LLu+baX+bKpkduDYhX++iGz/93XU/gcA1t+36fjnqcr4p/hUlgzGPYvyPZfNB6epEXdExJ0RcVdE3B0ROyKyvPdGxH1Nbn9oWXzl+LN8eVUVa1A6/ns2v7e1dPyXj/7+Swa78tjWGIjB6ClNTE6N74+IbRGxN3r6JianBupt47sXf/lsScLc1fmBd1r/dOxXfNLtF2PBvByXu/uWru/46MxoK+qeuvJRNgc4u7L+C3eu0tDOiNi1ivWn4+bJJ77aU2v5jetfRwvuMyVfRjxeaf8LUaf+y+9PFg1+ZOTwcH9Mje8fnujJLhSq+Onni6/V2v5N1b8F0vbfVPX4n6//YGnx/drpha7RqIu/fVrzmqaJ4/+tIiU9/ntLb2Th3jztg9GZmTMHInpLr6xMH1lYWxEv8l/ZsiPiker9Pz3HpcdYWv/dEZEexPdHxAMR8WBe9oci4uHIVlHN7LWI+OGFR99ZTf2b3M2rkrb/8SXtHzdo/+YDXSe//yZdUbWTZGPtfygL7c1TGjn/NVrAm91/AAAAcDsoZ8/Al8r75sPl8r59EZuzud1N5anT0zNPTpx+//rxyrPyg9FTLuY/K/PBlfnQA/nccBEfWRY/mM8bf941kMU35fe+gfbZvLj/ZxOOlf6f+qOrzYUD1p73taBzLfT/Wq+rrlD3gQfg9uH7HzpXE/3fqQI2mPlO3Vc/X7IOZQHWV7Uv9dk2lANYf901wsDGp89D59L/oXPp/9CRbua9/tUESg2/mb8BArPVd+/vtf+rP+qtsPcWqVcWiHIWSGbbWIx/88fQGsp8Pf/JyzUoT/HgXJ7yV+3MxU/E3AotWD/QvnMSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAK/0fAAD///gF41o=") prlimit64(0x0, 0x2, &(0x7f0000001e40)={0x0, 0x400}, 0x0) r3 = socket(0x1e, 0xc, 0x0) accept4$inet6(r3, &(0x7f0000000800)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000840)=0x1c, 0x80800) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4006, r4, 0x0}]) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000002c0), 0x1) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(r4) open$dir(0x0, 0x10000, 0x104) executing program 6: r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x880, 0x0) readv(r3, &(0x7f0000000480)=[{&(0x7f0000000100)=""/199, 0xc7}], 0x1) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000340)={0x3b, {0x0, 0x0, 0x0, 0x1}}) write$uinput_user_dev(r4, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x2a, [0x0, 0x0, 0x0, 0x40000, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x3, 0x0, 0xf16, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x800, 0x0, 0xd60f, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3, 0x5f1, 0x6], [0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x5, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x800, 0x32, 0x0, 0x0, 0x80000, 0x85, 0xfffffffd, 0x0, 0x8, 0x0, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0xffd, 0x80, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x10, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8000, 0x0, 0x101, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4000, 0x0, 0x0, 0x4]}, 0x45c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100"/52, @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./file1\x00', 0x183042, 0x15) write$P9_RREADLINK(r5, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file1'}}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x20, 0x10, 0x4, 0xfffff010}, {0x30, 0x0, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x2}]}, 0x10) sendmmsg$inet(r6, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0x1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000010101"], 0x44}}, 0x4000) recvmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x2180, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000100)=0x4, 0x6) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0x1000, 0xdddd1000, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0xff}, {0x200000, 0x3000, 0x3, 0x10, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0xf000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x0, 0x9, 0xa8, 0x4, 0x4}, {0x80a0000, 0xeeee0000, 0xf, 0xa, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x9, 0x3, 0x3, 0x6, 0xab, 0x80, 0x7, 0x2, 0xdb, 0xfc}, {0x60000, 0x100000, 0xc, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x3, 0x2}, {0x3000, 0x8000000, 0x4, 0x1, 0x2, 0x5, 0x7, 0x3, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x1000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x30, 0x2, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x406e, 0x3, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) executing program 0: timerfd_settime(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$rtc(0xffffff9c, &(0x7f0000000080), 0xa200, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0) close(0x3) syz_usb_connect$uac1(0x2, 0x72, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0x240400, 0x81) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000140)={@private=0xa010101, @multicast1, @remote}, 0xc) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r1, 0xaea3) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f00000004c0)={0x1, 0x0, @pic={0xff, 0x2, 0x4, 0x1, 0xff, 0x9, 0x2, 0x81, 0x17, 0x5, 0x10, 0xf9, 0x9, 0xf, 0x7, 0x4}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x103900, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0x80a0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0xcf, 0x0, 0x0, 0x42a1, 0x80a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x1, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 1: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <14> bisect: split chunk #0 of len 14 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 20, 26, 7, 8, 18, 28] detailed listing: executing program 0: timerfd_settime(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$rtc(0xffffff9c, &(0x7f0000000080), 0xa200, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0) close(0x3) syz_usb_connect$uac1(0x2, 0x72, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0x240400, 0x81) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000140)={@private=0xa010101, @multicast1, @remote}, 0xc) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_TSC_KHZ_vm(r1, 0xaea3) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f00000004c0)={0x1, 0x0, @pic={0xff, 0x2, 0x4, 0x1, 0xff, 0x9, 0x2, 0x81, 0x17, 0x5, 0x10, 0xf9, 0x9, 0xf, 0x7, 0x4}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x103900, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x0, 0x80a0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0xcf, 0x0, 0x0, 0x42a1, 0x80a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x1, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0xc840) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) read$FUSE(0xffffffffffffffff, &(0x7f0000001300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setreuid(r0, r1) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x2000000000000, 0x3c, 0xfffffffffff7fffd, 0x50}, {0x5, 0x0, 0x100000001, 0x3}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@enum={0xa, 0x1, 0x0, 0x6, 0x4, [{0xd, 0x3}]}, @ptr={0x3, 0x0, 0x0, 0x2, 0x1}]}}, &(0x7f0000000500)=""/38, 0x3a, 0x26, 0x1, 0x6, 0x10000}, 0x28) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000340)=0x1) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) close(0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) symlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x20, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e1d, 0x4e24}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00') timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) dup(r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) timer_gettime(r4, 0x0) executing program 1: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1e1802, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x973fe6a7e26878ba) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000160000402505a1a4400001020301090264ed02010070000904000001020d0000052406000105240008000d240f010000000000000000ed0524"], 0x0) executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <7> bisect: split chunk #0 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 18, 28] detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socketpair$unix-sendmmsg-gettid-timer_create-bpf$PROG_LOAD-socket$nl_audit-syz_mount_image$ext4-capset-syz_open_dev$tty1-openat-quotactl_fd$Q_QUOTAOFF-bind$netlink-socket$nl_audit-socket$nl_netfilter-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_open_dev$evdev-syz_mount_image$ext4-ioctl$EVIOCSFF-write$char_usb-bind$netlink-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-bpf$BPF_PROG_TEST_RUN-fcntl$lock-mprotect-timer_settime-bpf$BPF_PROG_ATTACH detailed listing: executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000c900)=[{{0x0, 0x3b, 0x0}}, {{&(0x7f00000005c0)=@hci={0x1f, 0x4, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000cc0), 0x10}}], 0x2, 0x800) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) r3 = socket$nl_audit(0x10, 0x3, 0x9) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000300)={[{@jqfmt_vfsv0}, {@errors_remount}, {@noblock_validity}, {@data_err_abort}, {@nobarrier}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd}) syz_open_dev$tty1(0xc, 0x4, 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1cb642, 0x148) quotactl_fd$Q_QUOTAOFF(r4, 0xffffffff80000300, 0x0, 0x0) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r5 = socket$nl_audit(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x3a, 0x1002}, @cond=[{0x2, 0x5, 0x40, 0x8, 0x8001, 0xfc01}, {0x9, 0x6, 0xff63, 0x3, 0x2000, 0x8}]}) write$char_usb(r6, &(0x7f0000000040)="e2", 0x2250) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0xb, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1, r1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)=ANY=[], 0x20) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 18] detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-socket$inet6_tcp-setsockopt$IP6T_SO_SET_REPLACE-syz_open_dev$tty1-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getrusage-ioctl$TIOCL_SETSEL-socket-sendmsg$nl_netfilter detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3b8, 0x1d8, 0xc8, 0x8, 0x1d8, 0x5803, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff], 'pimreg\x00', 'wlan0\x00', {}, {}, 0x2c, 0x1, 0x1, 0x51}, 0x0, 0x190, 0x1d8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x8, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3274e082555f6722282f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67442c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5000000000800", 0x1, 0x1, {0xfffffffffffffffe}}}, @common=@inet=@ecn={{0x28}, {0x1, 0x11, 0x8, 0x6}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x0, 0x3, 'pptp\x00', {0x100000000}}}}, {{@ipv6={@remote, @mcast1, [0xff000000, 0x100000100], [], 'macvtap0\x00', 'macsec0\x00', {}, {}, 0x87}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0xffffffff, 0x0, 'netbios-ns\x00', 'syz0\x00', {0xd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) getrusage(0x0, &(0x7f00000000c0)) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_netfilter(r5, &(0x7f0000000b80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={&(0x7f00000008c0)={0xac, 0xa, 0xe, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x6}, [@nested={0x71, 0xd6, 0x0, 0x1, [@nested={0x4, 0x6a}, @typed={0x8, 0x13d, 0x0, 0x0, @pid=r0}, @generic="69f317d6fb2c71f2dcdaf13c6211b6080a1791f6d1b531e6b3ef02f28a20bdf6897dd301d896672e61bbb8e7caaa476750287f11dd", @typed={0x27, 0x114, 0x0, 0x0, @binary="459f10bdda3ef4f631654d0864297a103ef0e5f1eb3a6e18e1597cb063315c43267b05"}, @nested={0x4, 0xbf}]}, @generic, @typed={0x8, 0x88, 0x0, 0x0, @ipv4=@empty}, @typed={0x14, 0x5a, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x8, 0xd0, 0x0, 0x0, @uid}]}, 0xac}}, 0x24040000) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$XFS_IOC_FD_TO_HANDLE-setsockopt$inet6_tcp_TCP_CONGESTION-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$XFS_IOC_FD_TO_HANDLE-setsockopt$inet6_tcp_TCP_CONGESTION-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session bisect: concatenation succeeded found reproducer with 8 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$XFS_IOC_FD_TO_HANDLE-setsockopt$inet6_tcp_TCP_CONGESTION detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='htcp', 0x4) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r2, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3 detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x20000, &(0x7f0000000080)={@_ha_fsid={[0xf7c, 0x2]}, {0x6, 0x5, 0x6ca}}, 0xd, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x69}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FD_TO_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 32m31.103544144s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88811eb6f950 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f5492e8ae99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb44ead78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffeb44eae60 RCX: 00007f5492e8ae99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000007111 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5493112fac R14: 00007f5493112fa8 R15: 00007f5493112fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88811eb6f800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811eb6f800, ffff88811eb6fa00) The buggy address belongs to the page: page:ffffea00047adb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eb6c head:ffffea00047adb00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, ts 28970078132, free_ts 27979538697 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x35c/0xb10 net/netlink/af_netlink.c:2451 netlink_rcv_skb+0x267/0x430 net/netlink/af_netlink.c:2522 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5672 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x879/0xb80 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2063 __do_sys_sendto net/socket.c:2075 [inline] __se_sys_sendto net/socket.c:2071 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2071 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1474 [inline] free_pcp_prepare mm/page_alloc.c:1546 [inline] free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536 free_unref_page+0xae/0x540 mm/page_alloc.c:3618 free_the_page mm/page_alloc.c:805 [inline] __free_pages+0x6c/0x100 mm/page_alloc.c:5900 free_pages+0x82/0x90 mm/page_alloc.c:5911 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:354 apply_to_pte_range mm/memory.c:2645 [inline] apply_to_pmd_range mm/memory.c:2689 [inline] apply_to_pud_range mm/memory.c:2725 [inline] apply_to_p4d_range mm/memory.c:2761 [inline] __apply_to_page_range+0x8ca/0xc70 mm/memory.c:2797 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2830 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:464 __purge_vmap_area_lazy+0xa8d/0x1890 mm/vmalloc.c:1723 _vm_unmap_aliases+0x2f1/0x370 mm/vmalloc.c:2126 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:2149 change_page_attr_set_clr+0x317/0xc30 arch/x86/mm/pat/set_memory.c:1740 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1797 [inline] set_memory_x+0xd3/0x110 arch/x86/mm/pat/set_memory.c:1930 bpf_jit_binary_lock_ro include/linux/filter.h:920 [inline] bpf_int_jit_compile+0xbf2a/0xc4c0 arch/x86/net/bpf_jit_comp.c:2478 bpf_prog_select_runtime+0x6ea/0x9e0 kernel/bpf/core.c:1947 bpf_migrate_filter net/core/filter.c:1307 [inline] bpf_prepare_filter+0x100e/0x11b0 net/core/filter.c:1355 Memory state around the buggy address: ffff88811eb6f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811eb6f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811eb6f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811eb6f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811eb6fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88811eb6f950 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f5492e8ae99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb44ead78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffeb44eae60 RCX: 00007f5492e8ae99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000007111 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5493112fac R14: 00007f5493112fa8 R15: 00007f5493112fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88811eb6f800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811eb6f800, ffff88811eb6fa00) The buggy address belongs to the page: page:ffffea00047adb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eb6c head:ffffea00047adb00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, ts 28970078132, free_ts 27979538697 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x35c/0xb10 net/netlink/af_netlink.c:2451 netlink_rcv_skb+0x267/0x430 net/netlink/af_netlink.c:2522 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5672 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x879/0xb80 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2063 __do_sys_sendto net/socket.c:2075 [inline] __se_sys_sendto net/socket.c:2071 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2071 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1474 [inline] free_pcp_prepare mm/page_alloc.c:1546 [inline] free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536 free_unref_page+0xae/0x540 mm/page_alloc.c:3618 free_the_page mm/page_alloc.c:805 [inline] __free_pages+0x6c/0x100 mm/page_alloc.c:5900 free_pages+0x82/0x90 mm/page_alloc.c:5911 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:354 apply_to_pte_range mm/memory.c:2645 [inline] apply_to_pmd_range mm/memory.c:2689 [inline] apply_to_pud_range mm/memory.c:2725 [inline] apply_to_p4d_range mm/memory.c:2761 [inline] __apply_to_page_range+0x8ca/0xc70 mm/memory.c:2797 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2830 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:464 __purge_vmap_area_lazy+0xa8d/0x1890 mm/vmalloc.c:1723 _vm_unmap_aliases+0x2f1/0x370 mm/vmalloc.c:2126 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:2149 change_page_attr_set_clr+0x317/0xc30 arch/x86/mm/pat/set_memory.c:1740 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1797 [inline] set_memory_x+0xd3/0x110 arch/x86/mm/pat/set_memory.c:1930 bpf_jit_binary_lock_ro include/linux/filter.h:920 [inline] bpf_int_jit_compile+0xbf2a/0xc4c0 arch/x86/net/bpf_jit_comp.c:2478 bpf_prog_select_runtime+0x6ea/0x9e0 kernel/bpf/core.c:1947 bpf_migrate_filter net/core/filter.c:1307 [inline] bpf_prepare_filter+0x100e/0x11b0 net/core/filter.c:1355 Memory state around the buggy address: ffff88811eb6f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811eb6f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811eb6f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811eb6f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811eb6fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================