Extracting prog: 1h23m35.175829547s Minimizing prog: 16m9.180600834s Simplifying prog options: 0s Extracting C: 24.35031424s Simplifying C: 12m27.088457066s extracting reproducer from 37 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-socket$key-sendmsg$key-ioctl$KDSETMODE-ioctl$KDSETMODE-gettid-timer_create-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-socket$inet6_sctp-socket$inet6_sctp-connect$inet6-shutdown-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO-getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS-sendto-socket$nl_generic-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-mmap-mbind-mmap-mbind-socket$kcm-sendmsg$kcm-timer_settime-syz_open_dev$tty1-ioctl$TIOCSWINSZ detailed listing: executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash program did not crash single: failed to extract reproducer bisect: bisecting 37 programs with base timeout 30s testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 9, 10, 8, 30, 6, 16, 1, 14, 15, 8, 4, 30, 11, 13, 17, 30, 24, 24, 9, 11, 17, 3, 30, 26, 40, 5, 24, 24, 22, 18, 8, 11, 29, 1, 7, 30] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00005ba000/0x4000)=nil, 0x4000, 0xb635773f06ebbee9, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000180)=0xc) sched_rr_get_interval(r6, &(0x7f00000001c0)) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x74) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r9, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) accept4$inet6(r5, 0x0, 0x0, 0x80800) r10 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x949902, 0x0) ioctl$PTP_EXTTS_REQUEST2(r10, 0x40103d0b, &(0x7f0000000080)={0x7, 0x2}) r11 = socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCGETLINKNAME(r11, 0x89e0, 0xffffffffffffffff) ioctl$PTP_EXTTS_REQUEST2(r10, 0x40103d0b, &(0x7f0000000040)={0xff, 0xb}) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) write(r2, &(0x7f0000000000)="240000005800410f9c00f4f90085b3a85c91fddf080001000501009f0800028001000000", 0x24) recvmmsg(r1, &(0x7f00000000c0), 0x1, 0x40002142, 0x0) sendmsg$netlink(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff090045000000000000000000000008001c00c900"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f0000000300)=ANY=[@ANYBLOB="3b0704000008"], 0x40) sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000500)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x2c, r5, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xd0e}]}, 0x2c}, 0x1, 0x0, 0x0, 0x401}, 0x4000090) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x28, r2, 0x5, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x485c) executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000010000104000000000000000000000000dfcdb32e3c5a50896d0ab061110a05b33d50909ea2c49ad254b223758fecf18a7cca4851adfdbd4d5ed840a288102206b14e2a53710fcb2a3926e1d880976d15bfeb77e2a3ae6bce1f3efa1620f41f72a3b855f2a129b6f00cfd759fd82e387dc6d8d8308f76dc5d0721f3bdabe7dbfdee34c382ee", @ANYRES32=0x0, @ANYBLOB="0020040002000000280012800b00010067656e6576650000180002801400120020010000000000000000000000000002"], 0x48}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) r2 = socket(0xa, 0x3, 0x87) ioctl$int_in(r2, 0x5452, &(0x7f0000000100)=0x2) mkdirat(r0, &(0x7f00000000c0)='./file0\x00', 0x99) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='cpuset'}, {@subsystem='cpuacct'}]}) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x40078, &(0x7f0000000000)) executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="bc05000000000000711035000000000005000000b5648f4cfbb92e8000000000f6f1d8725169fa27687bc4998ee157d3c8a72029a931cb6141871544461e"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0xfffffffe}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='select \n', 0x10) write(r0, &(0x7f0000000100)='file read /etc/passwd task.uid=0 exec.argv[0]\"\"sh= exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c230000) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) socket$packet(0x11, 0x3, 0x300) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000180)={0x9, 0x0, 0x9, 0xe4d, 0x572d82f1, 0x800, "646c2ffdd4f2e7e12757fe5513ead096", 0x1, 0x4d, 0x81, 0x0, 0x7, 0x7, 0x8}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r3, @ANYBLOB=',group_id=', @ANYRESDEC=r3], 0xfd, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x14, 0x4, 0x4, 0x22}, 0x50) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$BLKFINISHZONE(r0, 0x40101288, &(0x7f0000000240)={0x5, 0x4}) mmap$IORING_OFF_SQ_RING(0x0, 0x7fff, 0x2000000, 0x80010, r0, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r5, &(0x7f0000000200)={0x2, 0x3, @empty}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r4, &(0x7f00000001c0), &(0x7f00000004c0)=@udp=r5}, 0x20) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000, 0x2, 0x0, 0xfffffffb}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000080)="cb"}, 0x20) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000040)=@in={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4040054}, 0x24000001) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregset(0x4205, r6, 0x403, &(0x7f0000000000)={0x0}) llistxattr(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) executing program 0: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYRES8=r1], 0x6c}}, 0x4) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x0) executing program 1: r0 = syz_create_resource$binfmt(&(0x7f00000003c0)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, &(0x7f0000000340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) syz_fuse_handle_req(r1, &(0x7f0000009b40)="de98eeeefd02c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49b55ba4c2c444bef36d98df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc301dbcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99372601d27d18c9e29940503d3a12149fdc4fe0065c3d023d6e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b783ef7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfae097c57f1e16ba54f9028e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da468475b926a18254d23b4c44705aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a00af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c699acbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a313bcfd9ade3e140b808e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c689975e5b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f7d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a78908145295777dbbc4e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193cfc5540592ab1342a1a9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e503c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e1ac49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff297eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78b8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b7b1371e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e04616f54f15b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea347b9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8064d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807a5e155f4fad7149b76841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb5ddf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc8aecb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7ae66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1f69684ffb4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec9bea48903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16e343ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d209708000000f0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca6197add1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c0afebc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c63f7871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6913541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14ef36ecfa2f32c5aa899811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba8ab2df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a00", 0x2000, &(0x7f00000004c0)={&(0x7f0000000000)={0x50, 0x0, 0x203, {0x7, 0x29, 0xfffffffb, 0x48000010, 0x1, 0x3, 0xb, 0x2, 0x0, 0x0, 0x80, 0x97}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a10911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593d26430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccca2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f11832773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba87f1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde07e6334c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912fe9cd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c374b96ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe51ce7f250adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c6013042b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5b26a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c00", 0x2000, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x78, 0x0, 0x40000005, {0xb, 0x2, 0x0, {0x2, 0x9, 0x1000, 0x90000005, 0x2000000000001, 0x8000000000000001, 0x9ec, 0x35741061, 0x40, 0xa593e9c1ca988eda, 0xfffffff9, 0x0, 0xee01, 0x8, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000180)={0x400, 0x2, 0x1, 0x0, 0xfe}) ioctl$vim2m_VIDIOC_EXPBUF(r2, 0xc0405668, &(0x7f0000000080)={0x0, 0x1, 0x2, 0x800}) close(r2) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) syz_fuse_handle_req(r1, &(0x7f000000db80)="7f6918c94c44884d7b8a28634924247bb7227f95c895bbd9b1d304e96d5cec730781de7dae19f800f70a3f79a7dd3d71df24387c5c75ab544cb9f6046356198c15e42d1243561d3564eb81f867c971bfde8b68e2bb06c19acd4db9ff3338918a966ab2ae23d8a2d5d8329ebad40e96db51b70fb245b7876f6df6c6d07327f3c03928531903e5e783e0115db15b2833fc33d3b57f30f25e7b32d7d41f724e8b61cf82045c6cef472b58b94ad9f0b4746e47a86aa7fe472a33dd5d87578cbc83356e87ed9786be4fe4bbd49c4bea54f1209106ecc101b945d8bd1fc5f8f9fc04cb63087d76679c6985f9cd03ab2b47208be4f291c12a1aa95ec5d84137ef7f84f6bc37d829622c63a758886d23c509bb6009ee56c05ae6a79c890728b9028231456d8ba449755ac2a3b33f17ec27c69a93319f84ee840f08f379b53fd36a770b4353e273efce7392e2ad35975a1a6c9ec0d09a3e5052aa9c0cd67f68c0c878129ab13a46c2c650311739fe5658f035b08cd96b41b5b8b154eaa9aad034fa376ae9b906a93c91343755a26056335c7a3cd68132a957badaa133517f219b48dac6f8b9e073d484170e7c8d0279aa09986a4e18ababe7a67ca4706916dc14442ace6876fc039fc4895c086e6464b41c31fbfee4385bc6c8adfce87642ef7e360c84f6d731635579c2b78f3efb77a8cd7d985f7f4a3260cc8802173f6db768645cb59d3dcaf4c024312fb6bc6a77d177d838f976f2e37026927b02cbdcb2cf6f6c1ca9dcc90ad40d849c50085f4d1f15378f388b51a5c3a0eab990b8724fc2e39b4c5308e5bb2faa1e534a46c298309d6d8d01982ce3a4f5e7ffb6a32e1062735c361e29e8648a94daf71896fee3b2e5ecf3c9bc30d00f588129e3eb3ee8c3b5dda9b70db7e8f0ceb1b14bf4e823781237a8490ef28205b23d88840f9865ba8a760752bbae44ecaed810051ed2778864ba9aa48422c22fdb46b1dcca4601ade39a2200b9ca59cec048527da207d1b122da061f2085af49574bf9c9ff3534d8dc10f1352638515facb031dcf9d4f44aa76908b7ca8cb19347d83dea67121ae9f759df68e183a79e4f14b35bd18a47a81cd8cbfc45a772f2084f640d1343c1048dfb0da78063896a2f757637d767289c24608cadb0c98b0b8e525c5a6fcd57471b1a03f34008c70d60096fb25dbc1d7b090427304699a6e64a547c192388fa88b021644a38705645d0588e573f1052d56b2fbd3f0c7fa8bf713b77801fbeb7e53517326055617a45691a24dd22022b0f8a4f70da5792a66dffd7a52b0133bc8df01e7bfb2b81e15179452035b9a6f27f262936d7ecfafe97964ae4e6848793400177554bdfcae4897f0c5eebda209ff2e39326fc6bfb8012801432fb27723ccce88dc4bf26c9c2407e8fa19c2a5669905319e67268d0900c3a4de3825c1a6f3d256d62c1983d6136aa5554cbece1bd238161a7f7138d6b4d1bf4841c72ae9f8cd2eb4141f84947367c6457d37178f8dd3589faf2dfdc2a52172b5eed7ac6e65ea8a85764df131e05ce45e29a55e77625c4b47a823d726994956321af20152482d8bfa165fb3a59cb177a0a39839b597260e81bda3c1ce17cd84b5b5934f1e0c14287d99a091754b6430d8c7fe06ddecd1dc54fbdb2fb241a3022abdd5072c40fabd6a278bf12c2508b5222ecee996359fb7e2013280f25d63879fbc464c90966dc5d475fc0518593728e627be5683a782df540117cb0da3d0aa9ef492ac2e454cf8c4a34b454eb4ec4316026e34aeb4f0490d7d2b1a8cf757e0613b0348f10f3075a6ba221adbd3ee54a520254d4a3d4f7c012e6e35a6c3c7d5c321f12ed8ea1bea46161c26d5b2b956d712624435fc267d90b61c7a7929f82762e5708a650d5ed27be212a313bd603480857c26e118dc7b16021f090a765dd0b304aad70d16e7fa31c5c06e511b8a848bef23a68bd415ba3bce70d6e2d621a7c871e7c45a0e66e6e8f9b3ec58610f24e8332c15d8e0422ce3589639523e2089f68fb4d38b4fae820b88fc67a0884249fd509996dedce14d307e91166f90da5086b4574e922137b60c859847e54f62fc6d13ad5b79f7595999d54df6810f6cfe90e81399d4d6f905f569672f6f543572f87124b56d26ea43f66a1c75ac1ea26695d61599fd8db6e7f8c025393f948ba9e3ccc57270f371d3d31589c1f445388c931d78ae714a54b4c0bf1b0c8e4ec49db480c40b1df7135e5a1cd5d427fdb3fc8689999600f474f2b98312b89e8102e231258ad7137a3eed49a26f1ba3d7624e7ca647232ab36fb2a73f85f52c752bb32d61c2b6b9452cf279a30e971322cad2d6430a0d9f4902c9ce4b43054a4aac67250f9967523d57068616e7769189d3c513cfdf8a8bb37ad7932159c819af127eb3abee2c45e78ae62a3f6022f0e9de7454ff51ebeefc58db63803236b311087af41efe1cd5b82fc973a047565fb2c428a20052cb578e1fc6e33a66b331f53045b69efef186a6b34e01d089197112566020cd78410657e4547b726b48aab4d3d49554bfbbdf9d3598e93b412796931c2b662a096618deb94649cf2a922b2b6e2ea44163fc460419a8c5e88a18a05ee96392573cf2406affe801955214891430da0ee4ce385b013d827fd4adafaff661741d447e7be653efd5977bbd4aef922c076e91f391607a3f60d105753cb8e44aeee51e90aba0c52f731885c9d459cc89a1f548874009c5b6938feab5cc3f42721f4c9599fe74a11fd2f898c9fb3401be644a9ff6c093683e90e9a23a544e778fd5735e72eb432dd1ccbbfa9db14e8b7e5a638895edcff4a684a9d467151cd4b8d0fcebe3481b4c9f18b3279cafb76ed7bc5bde263baba9ab032f8973c8e1527f26c56b627a312538bec70e3829a1b35c53b0ca64571de79514c30c98cad975056a98fca351dd1753422e81733667098f893f1375736d6228531b97c5ab918819ff16c7eb38d33f0a1f023d07f97ce5d1d1e4b71c9a292aaee6522e1b0e332b7ad6a0248ecbc611e93652951ded443ba05530e2b6ef6f5837b2fb214db180281ecf14e73064dbb53f002ffc12038b8d720f7fb919ae92c423798fee59e1d20dc9002b8eee98347ec86026a293545d4224a334d77cbd68a39e698567b47dd296402b1a91b31184032ad5c07f9766d96a3aad4746153c3060204b6fca81b0e4195e54ad6d963526c2ce74cfece9b16fb93bddd0965335756243153faaae2e299b33eb8c2b58b1ff26714e3479418d77f3d122c2a397b851cc1b62ee272129137037b14312a6535376c2f8a505434bdbe1f009898709790a0cd0c6f265d7d2e93b22319991dedd018d391b9d824af7a0d1cdd08e05b961ef867d0bef9b56791bd34602af6cf812e20d7f1a68bd66b5b30700003b6fd06e690baad26193ccb4806057068f4a48cfbe289e718215b368ecee46b30088d38668f55e04f8ba14c26264f10456acab6a0982ac251ee1f2e2f612e7d7f4f9c7399972013844d442334aceb641e7b3535311488925d542a2a4000eadaecd0e23238bc3740beb45ac504b14591fbbd7e1b6015fe338c1399edb7d6dbb539d34ad9ffadd665e5f85b918f3d1d888636a84c7e685453bbdf9a5e22fe80f8e8b72ebfc1a2db75ae07edd9004f7d95481459edae62388c75d8be87fa491daab39e8f0764809fb6cdd0c1a501094b2ece56cdf14b5a92593fe8f158f41c0f77e0fbfcd8a76bc805895014b3c4a1ff8933bf07ffa971845441a27c4f83c682706cd03b405fa87224216f178403ac871990cdeb1bd75cc4dc963e4ca23be0fe9961a04cdb631e67baa1947c154f106ed5d8afbb1a6b57314603200a381a83446e5cb6346c484a878fe4339f0260e70f987fc73c58d4b82b853dd52b1967eeb13f724ae92b2ab490b8457230422cc1ecdc2860d730ed8cac393f7fd4927edcd13c8c8d576848a24d973172b2b70e9467dd6e28bcce21eb34d8cf0e2da165b18851d5fd017fd7b74eeca936267787870131a203e946fff450387ca87d5a6fa3f95109a9671cf4b066ef881df3ccc8902f67808c01e1739167ecb59b6cd8a195c62837348a2548708ce553e9cbd3f2a75bc83996871bcb0e7fac4d1e68eb3302b42cb46d3b8d1c6a27b237b3b50d87874197a197357178ccd8fd7575a4d54222ac1fb200657cbca5683303f3bc7a36ed0418327f8d1df336af2092c544f6226ced77b63445d913d328f03fb8889cf54ee36e642b37638d203c2e1bbb9ffa33d1e8124f7dcd22e98f66519f79a0731f6c5f1a3417d7e50eb39ba9d9a0a8be11112d1de4b6983ec0436cfcc5e0cbfab9ceed17a75743f70173649e8650a0e1183c11e62d0a9b566641feb8261432624d5116a6cc0a3332945f4aac41d46067777261ed028436220237340eecd76e820cb434f50e88c4c731f3e3f302220baba2a346683acb65008f4af74de5112cfb15be1d4d5fe080098e9cc447c5ed48eed2729f437f685548bea6842eb33bf7683bb097fc400d5be9ef54f79d8bf53ab057a431f535309e9af11783a5ce371ba5de8e517b767ff1b1d64efea71bf44cb0974665e4142f583489bb3b3870a779089822f52136bd34ee4b97276992bb080c6278be503fa06c970bff455d9d323fa2a7baea78e03b99a57ead6cfc90ec1cdc541e06c0ba80f23a03756e3d3d56b6f7cf7fe706cc9fd10395f18a6f1cd019e57efe3c49cddcc48c42890349d1255201c928d590ad6963700f91c73b8e522e9950ff9088f1b5365de624178f1e71168d29644e8a4dd9b524aeaf70738dc16aed5edef1c18365f00d6a7f8b1466b4da1a3f0981b491f79a87ebc323c75b12b292ad9e0ff34b615f57c1dd896e7eec65d075d3a4414769af553c0fde01d73196660c3401a0a5a82a5099564480bb7fc10240860bb2813612122c580438403a0fbc3aa5b789af01a4392163345291e7c83e57f20e9f7a9b4b234308688956d993ac0b4d4eaa8f714a5059734a5e1d47c98f93a40f60e77511e463e4fcbad3410882c553da9c7845b8554ae7e070f04c6752ca58363840479ee570b2960102814dd963bcf69d3a1279e5d6bee1ca28a46c0f34626da074053f52ac7eb71e05702086d3b23a250e7b8c4c0075e366b42fc64d06af19c49fc89a441182cef130c72f279f56813241e51775681aac365459bc24bb4bf59819c65df280cf1d11650796f35650efaebf2d4d00c9ea7c49dc8e7400e3c344dbfe7e93f4b70b89ca42df53dc42d7c0a6c67d8cb28c711ecbd945b3a21a412a10296a705c447c4a46a2c62a63a686ef467ee736a25c23a6e9496d35257b58f21669300b33d6e5abf93fdad59ab1f7358e07d0e409c9c8371bc44d42ce5da24a8fb8eb5a3aa55010d55358f72033c59a4491851002fce689caf1efe7e61016ce511c6af68fa4498ffc643cfcfe992f3d4a68987c27a1aceb06a87c8ae6fb59de2d5b6f01c57cfe27738531b0cf87f3b2ac41e19c4b51f2dc54514513c740bd2a1a60a7210afa6c727352d00b1a6b0c70d44592029eba80bf0b47e7bfffa6865d4ed213e9ad66f28ac8066d3e3a22f795c374de53a07b8318ef37b809601b2ce19d18229d5c9190250a9b0a27c500744b359134dc7a19ce9ba83b586c7c4190610e807ba13a62fde4ab8c443311800b03ad761a77dadbcf91b1fb7de0696d273b803d186f22657feb01fcfc00e2c38b4b3e77c987cc10605429e6a5aa4a6e55397cf8b7252119a8c90e4c5ab44e035e43f038e23cf491e9d0cb54155b38a73f781b7ba3973d5b011fca0501ab228bc7a07d52c1a417f2d89b21e32d7b54f0a7ceb7e5b3bbbf30093542df3c2896334a046d9ea5bf5b39c65d44bb4fc0447496549a2252c5002f4eacb09659c7d81a1b5aa36019fc6cf2dadc62bfb923d573a245b01be37872505081c28d95c023bb9d2398614cf8c06b48bcb26c727d739d8f970ac8b430001f32a11d60573edc125551ef19a46f9ed274f7da3962572d741a38ebfe2c79eefde7c0cc6f6b800bd3c2c3a3f397f109550e3339044968ee5d76a41c74d40cf7a9f9e1f6b8917037ba5dd5faad8a18380ce2c9c78f70fce4a6086649bc0bbd3fd79a2b96083a82ec212ffc00f98469b1923773a25400fdce8f2d6f6c5aa83e8071dc3073927f7901bf9685f603b246f46101ea69383a26277a7dde0aad5df47bfd9dd2dbfbb9c82d4c2536d687cabd85876725fa98220b85387ddabc59f9e065ab499cb19db370f4090edbe5203255c2e7b9199e9f7e3fd8efe96c760e56a8a0b581d7419fbcb7bc05b0ecad49980a191f3c572a3f187bbc7c9aca7e07631174be92bc42e31d420466503cd8eb65ff81f2fc87f262731f7f9a3d70b2973baf6a0a45e84aab447cc33ae5ee7e7e00ca346ebdf307b32f6a2792311195b6dd4458fbdfd63aa743848be5f33919fac774887bc2e819afc2f18b639bfbed1d4be7aac932ec64d1b735fd58f23ef87e9986d70d734267ef75b6c37d833d7c7c9abfccaf77e300e687127eda92dbe586d2821a50028d2bf073e8e628fa17c30f72d4ab734c03e665381de9b2c6bc56d3352a05db51c6b880a503368286a12e8eadebd62d5176725444700ee47c6d129f95ee724f7c15f1c6f8eb173482295789b870b1c307841e9f4ba0cba08f67bf38b26e9a7951a2bb6e1b11a864d468d26104573a23557e376667aeae0680086924c6be4a3b1cd77791a461b69bbbea5e2bb1662fd09fac1e4c2a4c3a9af4e1d1950a61f6731b84ef80809c745226c4b5c973e2ae9db0a0b89243ac24b6211a7dfd01ce2ac794bb1ddf4971ed9e03e1b48b15928de9ba1ec10d25c729e5aa1791de3c24f88783bece40b2d26f818a85412631136da414dae2b0e84a4f756ff47faf50b993ca2b1332f946bd60aaa244fef4c44e27abe18e3c139357621cc3f2181078619175019f07e8cff2029225657e869ab2f85f7d0da1f4ca725213ff3c54e9c8bbde165f4e7fefa7703ff9aaaeba782d09cfacd1b3ae70bc59c6721a487e9a151c2c2d6c374b2c9d7437485dcd9aabf09c1e8adfa2484f0e5972ede72ce13d6162052c6a94d8cd742a02996bc477a00a9180744ee9ea3d4c9c8b033c23076bef2773345d221c294864bc8b20a0522ddea26c0f9257db1abf991830cfc08e34d0d6f3225c425dfa7661ef281d715756e967ceacba90430f42bc906c39415266225041f7f400060bb86a43ec1f8f050f5c3cee2cf541b1d5f3e13d9613bb97d7dc0e58c5a0f4b11c572bceda5b632e98a9172e1b45eefc4ba808aeec0d3e40eb121035d174147aa1e54b8d5f75b630118e12e7688375e26ed745a9c50fa8a2fb023571c40ef4f0a2da5284d0ee921839709a3df86662dcabe01a592621a5c57d88f3dd7b1f1db695d6f577b024e004d46d4a463109befe04ad42776dcbe46ec9399d88f4b83018baa453c981d2639af3dcf650777be6a9ca936c1619cdedeece29c2013237556d09dd983d56a3cc8bc6a3a2960daeaec4d798637564eff409248ee3f9a733e7d612812748c63650c9f75997953e5e781ad48c1bc3a5c4d85cb5819acdfd7d593d615b6d09cb072d222332b6f8e23bdca8ae10868534519e250f7052b009b0e5c132726734645bc9850ab98bab08665887f4c97ce2eff5d8603066d4dfc2d762cd45bc96a7b2cdc2ca557e9ffaf0f03521a0680e30387706946c3587996b2751b5944147c7344b51cfd30e70da869ef1a5d8ec2ac8f4c56d4168f20365690c995c226840c5fc6b1f998acbaf4bbf095c314aec39123ba23df17d36ffbf48d110a6cef7b0d49cd34a6a097b31fc05025924e32df666c9bd264d62aeba0db0c6fad6513bd366c1c788661bd7f86fd3e5e5c52963a30a589f2266a0e3d0d00245f9db624bcfacd3328a9ff9c1ac6ed9495b37e56bf3152ff3188d2a5a5ec3ffd237468fff8fb42e693b796647020e1be6689789fee77045ef0e99114ba5eb55055805f012cd11a6d4a3cb04b1dd6243618cff80cc8a980325e9fe55e1acae084bc353fd56b8a500614c2f4997358099521a7210024d03e0f31f29eda6bf96eff0f741d90bacfb4fc87c15f0a924b38facd926a9767edddaf0e328ace267367a7a4f0efd04ba042457f306eb7f201faa5709e4052a162cd33bab0bac9a0181c0d383fd17957a9987f1d24e80901e6843beb37e7e13a076e44576456d3fedf50afaf2fbff36b1c7555bd560bdfdecb37412a2a6b66c94f988668d05eebbb5738ef09c7b9c1fda542f39a4f7d3eb2902d9c144fe89a4c33d77b7a053d89749a1260a6236db383474e8938d0c6a21abd63fe67c01d9fc16a8821c5709a22949344670547174223c3e13117ad43cb4e1b39903c92f9e548832019adec859e8ab84952b379f80a81451cf53eee157ed76eb0c816598e018195d69d9bd01b0e46432fef38f7cce7e0b180b0e16425ba49fa2d2cb99a5525f90e04ceeed8c8643592e64756e0b9911aae238a475ede1378e709cd20144d779e6aaf9fdb8236dbf5fe3f60d254fa19bd2c9fa950501894b95f272f6f4236625c5b2108d853f8407298a90947447c0c5dad5c235144954dd197493fc9fcbe82afea68cc29d3e53c16256c00d6ec40ef6319164a70017d19e07747cea22e668d53115f66c2a222dd3ab72d3ea6712f539796010c122aace09934fa37f2f4564d19ffe320ee0f0bb252e5b9d3abccd3cac62d7700a8372e19b981c192c367ed4182c94dd36771ab70d84e4f993de2c7a6d005c648b3ad78a065685cd11621c0a74bd4444e7e1183bb6b175bd43c7f5986fcd48c7a5522449b3f38019668a197bb6ee510719a7288d018ff4a72ad18ab81f7136b5f0b9f23e63a69d8ff174efd824a9ae0722a3cbce8ee596bb6025ff9a901ee70c462c01baa240f93511803652ee9fb2bd19bef2a849e184e36938cd2e1220157a8ca376e8a8bbb93669ba1dbe3ea2b5c5a55ec02cbb1393eee30a9ccfa22f22fe7fc888be74e00dadc9f273ef252304cc10b3acb2d320c74800e8397ce26eb806c9bbaab24c3bee318669e62696b05ea586068feabcff9e49967b2f7b1698f45a086f9deda7d8a26d3fe0723ad1a6ea3dfd10722e960f270db5a7d39daf6c5bcd822d4b05e10f5ea53d9267d13eab771405de136ed3a77c8f2f483d543fe8a5d7d1f34b39e78df05c3945a0f1ae184f641eaff54d92e739f16dd7ff3bb7f4026281eee4dc6fb429f7715a6fde415172d193b913dae9e73cc8c690f597ec757801f503fab84579f21721f90518b4ee88c0c947dce61fd5bcb7c58d4eb45d06aac0d35c1a9647ebb3507c0f8a2dbff36d03681929b942d7202ea575542f6921db5a3a933ff8ba2cb066f028e216b64d281fb6a236481d57d71bd318930fc1ee1d9ad2113df747c592be3d244e5f42957e468c0840b1dcd6cb82a5ce29ab016c7294bad05a6c0430929ae96164597abc25b6f746c25f50fe98afdc04ee696c620b923d15e211360b8c122f9c0fa8cec463c8f7a45a1eb054e2480d4f87a14a9ebb3836afad1d02234bfcbe75ac0ff43d1ab4b8c1ae7067422a2a1807814d53868959e8919090e6af016628ebac18684bd238d99ba6f16053aebcd69dd4ddde9db5fe0b6b431a316eb54d2ae29b695430ba60e30e3fb169bb3636de169175e5fcb52d13ed918fdaa0eea476df0804a3af0dc468fbea1b263b92de2206c7aa9ff6a85ebd5a578c60df6611a3944d79d81729fefd0562cdde51e8108bf0c273359d596e4bb85dd888168de99b0a6a81ae74ac3759c4b986d9cca8fcf60a536180570f0be902f1e96d960d353dc38c684eb63118f27bfc167f971f76a5863106889cbaa47f800436405eac62a14ff4138c712f1b45eac7b531fe548cfa6918f11787cb2c84a157a65a9e8668b2f3751e51a943423fc59a691ca16de178edf0c2a8e897222356af56490aaf6a0a8a4153f43ec3876a5bbf27a00dbcb70dfb885c85c419556624a18800bef8eb4f3e6e138856b1bbdc1eda17c1adfee5966837da52fa088c532e47263f5917707b7f08408d3461d4dc083b247714915c7c751ac0f9a6118fb24cd759d04f33043892e509fc12c73b17d03541749ca82ca2992b3aef51191e02f8bea747d0690a0991087761bd5e23b6289e7dadc6025276e9bec88858357f93735b01718d1d250b80381354ed5a782413bc34c08dc4b2aa91f2f6892a116cab3173b74230fe109e879ce854b1bc7047b6c8228e18797f7a355eb502aa0b012c82e10f7bc4bc91b149c85b8696cd5735c553347c26212b36dc9e778ac43dfe139a319e9aaf3c5643dc476a7ecd9f8f69e6b5ff54e2b98b6ff9f3aeb6ffd0019c4c6cf5332c1fec541ca45720e88d10f9c04352dce307053ad6e0b9b1448fe86b893cdd3a0caabc5a42772b186caec04e029faf696a842f78fdcd5bc6168e49656d9922d3797ab948298d830bcbdfeb2a593e38ac7f0c0aa10d70c4a6b110d3a75aea66af29ead30f3d03806ba9b1fc2c42aa27627e0647209b07ed7317eb711148b8781d9c6a79317fee6277951d9d7b7d8f823c046b3f2cd22bd809fc4c17d27c9f1c14269f6846f70bca0eb2280e720dff51082b40890061fad286ad200828a58e50391b011489e5b70d2aafe165c6e609badb24c0b29c05ab48b296a2b75a27aec0ca8a5b5eeec344ec2ebcdc2f7910b0b136b925e1dd75e3cf0739721f0f6d1df55e00445bdb630d801fe51a16eb63019df487b91a556d0ebcdeec1511b251679df0624bbaf8b0f53262f587cfad05f3587ea7ee22aa4b052013b08fd217fd58e8b918d58fb9ba50c1998a9ef9a42494392f8f3087b5d18512472420450fcce13ff6a56a5b491020f91a586decf28171ac13ad0e803b4617557a7335052b7468e98179ee82c729dc9422d4ecc87a4c6c308caff8e6ef4c3fe8088924cfea53d760d17008a4d111db27ead13863e808bd13b8bc5341017231fa1c27d12a0630b5472271354a1b09d85c90e4d0d731c7233c163c6d78fe48ae3f665f2e75d922e77a48f949cb33d41800360d0fc7cb165b6f4e8f3c05f0e1b9ce163f288861ecc7f3e134cac468795d3781c4aabad5d88fab0dd780bf913a19102a2be74798cd737d62b0186b641dc89552ac444ad60685e4c3118e8296972880f69ff39a69dfa38e07bbfe32fef1b683edb340f8b8ccfdadca73a44488ad6807c16a8c3a45111ac8664f7b85a45a28a6fbd4351a06521ebe22feaba53229c9d13daa40d8762e5eacb9bd6a69c3b37230c229348307ca24d15305a8667f9584a3abb11e5135146e3fa90769410f7dd04bb4e7744f28288b84dfde7aaab141d582d9faa5dfbdd36e6d3da28f627e05f39ca3cd24fe6cb05817c528b956e623f74b747b56e11fe93f40d881b59ff7edaa26d583fcaaf368a4247fb338759e5ead21fd8225e2436a336f95edf783fdfbabc7813f4d9a96613ed01e22becb25634ce3e5a1ccd25f6328c8c60eeb09a5484743bf0c90ad2ea1884ea12263b4700f667a2cf4649e7185c74f6e1f707d45db83563cd3cf6caa1a90da482d9ddba7e2c0bdbd60d24f00", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x0, 0x4000000002}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f0000002100)="85a335dda2f0130775035b00681a0e8608ee77e9c4eeffde96bad7b697852412bb4ffcf7e7312a20b77aac3006dd3073cda855ac36c2c1e05b2c00fb6da1810136acd929d81f55c576c79b6d6910ba879625ae37deb784fe73f5a71f276b03af82f4d29c96245cb26ffabe7cde54911b38faf6a5df02534b93f3c5d864c87fff2818b2eaaad51dd906491045050b8250447af44d18cb2133a03bdeb8cc354cd190de33d2d3753dc7fb28848d58086e1e1bb83d0cc16545acca7a0bb6c2899b112e83ea83c635628a0b1f4c794ef0fd4ef0ef73a2e0a990d1aee6019a4e50de2fb851ac1fc1fd16a047822916d475b82f635f12c2d8896bd2f5152105bbdd921db75517b463de6771340ce7bd48f361d51f209f17857d34436e1ee1f5c534b3d90843d0b824b97501e05e1974e308aaf3d0b32a527013cbfafe3dd88a56e7d2661dac8cb88193215a201ede3416c8c74e86151ce3b7eda0ef43c305c847a538baf08d278367fda01edfe05985716ffbb001bd2b9558548e6c5d64c43f413daab000decb50974a151c1353c5d56606fd95558d836acedd94a4e288a0f6270873286822ae034eb9cffb6614c32bdbe68858c78c8ddbd34151b9592454450d3e5043c97fbc07a4ec68e19354279ac8495d2a418a2552bae266874e3ab175488a1f58d95d870ccc47bfaeb079eb59c960028cd852d4e37b391534e898c6ba72fb144c312077613d30e4b4a2078d051db1e2ebe58b4ea02a7d12b30b35c411b9295a8dfeb4eaa9c7146a4b3964c6ae08e84edf58e963b6bb1beed8f29fa7eaaf86bae34a8fd543d0c634a87a1320ac6fd21faff21e4e3c115087c25f1c1dbf71a7ef4df1bcf3bed3cbf416f29fc36ee3562c40a96776ec7166dc37d8b696f10b9682b6fffdb513c6837545e60995cb1c71b07859568a0113582a7048144f3277e80734412fb75b8923a20b6c7ef50907e28f094e175a8cbad2b842f00e34eb96df950b4c9a2824ff30f4c0b318a132999e59883ebf259b09f837fcd4592d8c6348488643f374cf28d8bc6dd15e7fb780cbdb63d3cdab9fd8ed7b5fea8f32b78e1531936b0b24a858b900115d6d251fc3e0192f046f2c39c783ddae2eaebe508eb9c3106fd00e14d68d071ed257af1302b7774b7d7157cb5357e518323afe15ffe7170731050824b4d1bb355b1cb67b5f67b51d425d52aecd3b992abd9c18dc8a02efd60409d3b11a79c1bbcf46da66b2d27c0f6d91d3793b080e6334d49489a2962f3484791f9ba5e768bd96f12b7af9b589526a2a502527927e7383be94ebb3eed7cd24e60e0c9534b24b8f274866fb3f368e495d126e492a13e5ce72463daf409c7f96759ac18a5bf098224a93a65a918f97c8783081788d9c51257857e36f444f5a660910bce51f154b509a2f939261dd9e13c65e42acbc7d9ef57155a6bff4f3448681d0f959a7e9e174adba0d9e166df920f9e6f8e9a9725a35b1b2325d1323e3aec176d1252f64710356498799ece3049b9422c9f73d15555884ccf89d210f51a9047e2313120696921d93c8750273f05a05e8845ec906a3cd21d6287773b3e73ebabe90dfb1ef3b314ba2368e6cedd46253aafd2e2d2ccdf19358938f0d607ac4583b9a8da65447c7fb839d72f176881ee730dab693c05b5d3ddcda00b399d4e2406d20eb5c3af886a46b04bed29dc9ec7222205d1df71267ace6ba0deb8c274b3d1ce5393e41068492e02a93db8145e70d620c276792c94eb93b9e3cdd488e947d8cf604eed3835bbb44745420bca8b1f10b231510905e609fcca77b9a961fceca22e8654fc7e91ceb7a5d884ffd415be00e8bcb11ead9efa99851ec3421ba94491de629de6a2673d7e44bd1b79b61a3d35c7fc95d2b39ca30e2adcfe27226f80f644aa2b3aae6b4d73b4dc37985e21f54a457118e72f026c4d522dda695dffc7fad413e5fdb6311f3409a0891a3b8566af38513bc601eeaf09b30ef517d5da47168808a354bff25a1a75a4a0759deec1b238ef173bf8682c61083848af9a78e270be5ac71c91b7713b93b41b6d1dc3134ee3b5b8486f8959f81f506ada9a2d3bf243d991fd9c6584113998c89fafab91eb657ee48a276da191c83c1c31005bf06a807f3902428ba79333554c630b3b9e5a3b38883625742efa6f7622cede08fc0fea058c75c1f85a806c7e6b229df7de0396b127935965b6329299d24cf94b7f6a199e6bca90d24834ff3e37bcbea33c4ca9674c62f8f9fcbba53902012026bb390429fdfa97cd3fac3750ead8185ed565211071f51a057097efb42b6bd0b64f04dfdfffa70e79ee1d173394ba0b6d8e37797ebb1ba1114c3269eae2c745179cc3c19b5782e63743377351dd25618f2c73b5fbe9f8ba383f299457c595902e36a3f36a1f70951a4168e8585f87a53ac76ac6aafb315973d4d3b30aff49d0f96f0c4cded4bc0b84337d50f62f4820bf67ebd536bc6edca5ab1d4a2a7ed03bf53f4b943fe428f6a715eb68e74374b2fecefe15e9bb4eb8166965334e9ee9b12f326058f0fc37be9fbadf364c900f6da53b1e05cbd50d9c3cc6b6313b273da741c99c673a9547fb9293b8ebd051e6ab6a11902c9007985f8c660228cd02b096068bfbacf8447498a4ae33f0f734cc8c3f476d6a5522f3d091ca0a13f10a4cd4f500f3eb860ce096e8bd166064b3ff819ec727b180ee9d460903632bea85a0534fff5c9a17555d72de8f80ff7554a8e1725d54c0677e0b2f99357e047178ff94f285611dd1268853f7bbf405cbe013c785687c251c514e830167a386c2c1bd776d25ab8eaca8a16268a7ee844c152adf47a8a76d88a4d6aaaa8df68c561df51277d5eff4789b7c5126b010c1faa00cbefda7683aab6bdc8123081e13a186ddfd956f8d48ed065cf62941fd295ebbacacd46e161611395bb11887ca3f91273a3ca9978ee797c97163205df05f09dad6e9393d3f1b5bb4cca59d246be4f80162429bd4a21f65924a24072fa95775300dfc2450b724352e69f8c79f1daa23b612d5783f3172f6dae4ec2b2226788f139844a308a7b5131956565d1b5fb042b1ad4b00f8d0b61d5b8f6f9e3df2a1539734539f8ca8c3d67a4e576f9a24c9f17674cf9cbb617ebe5215d86f357cceef59815e6a57a6718fd6408dd49f9bb82137b0da168a384c14c35fb8611e8ed71b7ccd1af594af1a39c849b2be9b01c967036a426c0b7a42b51b8b1dede1f148597b8f843eeb8bdbde7155a4905054688790302ae5a1aad25a2c00f6d28bf07673393c18c5003638441e6fc0db0d04f828989ca61bd0bae4eadd44eff485e8c05ee947f994856cb593f696171e4da82acdda16cc1874c16eff74bb63cb889d43387cb4510199fa9bdaa44a608d7c62e7f65ee12d2e94b9b8206cecf9a396d56a4a2323b8109634fd57f47721b2e15361afbcbaea1e4f7fe25a5b04f8fa05f72012395d076c911570cdb5bb0bd59066cfa4143d4aef8b29a1185b12f305a38b1c0ece02b4170a25c6a1a222b79269596dc93c2e766f5e432c8e706d294aeb00006c20c95f914e4bc93ab21958bbd44a696ccbd00d0a523eb67f873b28324f9a872e0fe4ecafc0cbd1c0c03b24536be672b149007209a0095cf256d55d6084562058ab57c58361d6b72398bf125e7612b33820a0993e608ee2d0e580c878b981411d5367d45ec33e4399c177ff6deb023eee53fbbfcf7479e5510057ccd72f0f92caca99147380bf7cdadc05ee7bd9ac3eda166a59c09ed2d79227aa73a27aa5b1a392fbb59b44bacaf18c2e05817dd66691845fcd4faf8ddcc6c967a78fa3305d3c76a5e4174d5acb971700a22d55faff21747bf8ec0eb08b1307d9b22b7ef7dbffb200619ba6bf6ecf8243da82134dbed211938ae3488d1c91969e5dd9b8e1d8716180c17f07136645d4d6ba449aab42b2096bca4872046914ba21a796be759e00912f6f89a3260530bddeaab267098bfda2df8198013f7a33d6989a69c02ad5cc42977ad9b011993332e4a9ecfc3c775819856e4fcbadfb7a73411020dd5d3e3ff53ba63ddd8ab8ab2a983f638a82f8547795d3dfc905f35f14ef65d16f335bba6dd83aab4b404856a6b4e81d3b9787230af58eb61e5309a8ebc2d87a6c501f68162f3f59f6c726f5f1e87570b762ce5a304907965629a598366c128b7a4e255fd97de442bc6511d35ce075e537cdfe374342be68d8bc5a30527acc2abaa9336be5c58d82d69a8b2f6d68573e8e66ee2ad0ef3f06455eefdbbc8bf771578d97d1f5d9b4112845e50118c8413f3d1a81953c4b9f00fee96db14addc0c03bcabd7c1f10d85b6df2c21ecfb5f747fd7e29b23dec0efab3443e6053b0e44e4d831849f056e69bbdc7e12c568e2b03b33df411eac906d92cec9009906c2f94ed0ca898116926ac9b84d8ad83dc0cf46b36ba0a100246086c93fa4fe642da7efe01a0f849644594ab9ac6b38a4932c1c7d1f4a4caefe1daa4a842af3bf4256c635be0328ac078e08cc5769257fe114e8d2f884018bf6dafe8d9a80c76ca613f01f88021b20497cad499c3770035c9fd8da92c894b993d68bc91b6222b29c7a4f4da98c8d057b64f184587263630e6a5c6f98349d64f861c65be3ca2c9d11ac1d4300a8126968a73c110406bf9b20d7547ce1f1c31b329539ef50cae78c057f46f9a57083b1052ec6bba8074c1ecfb26cb3afc21f807fcd71be905d9e881e1764fd97ddbb2af77a5aa2213b0b42e43079bfc6539ed7b3a2f18da6987cab467d3e59bbf5592bc480dec832274e05aa0ca303fbea203dba1a8a0f4a982df3b62bb7a09375b397f8bf93e71d4b82e8105318879ff43c7cafc46d425dead4c24a302fc9d9e374c35b9a1fc3deb8583d5e121a8eab3f9b7f910348e784fe9e3782eee9bcb6f8d7bceed4b2aa174c2a4b63dfbb1fa5d07c795e450d0c7e8d85666173920e9539a61863488b8f4f86ce71336f33c7c0d93be5f1dc49211fe72e90eab52f5e661997915998ce38ca43e9b4f41c234a28a3aca2e2cd0ad76b886d80c4d77b37d1df88a2605d5b8b0d8599eeea58fc26dd19a4af9893b98b5eae2ff8e17b5dffe96d1f7758ad371970863323fb07fdd3e045ecaf1a5cd0489fdd03cabaf9a8523de5b03919c6264fdeb82401be394fe7720eba131cd36f74a447d52b12aec84edabddc2dc370f9b73036948d673603993bb7537486a4f3d6cd2286902df52c490c3ff9abe66ba1eb542253b67385640e0bf88f0430ed68e9c478bf1b36ade2e4172d562dea5abc96725c3b5f06c9a2555d57f8fc1d749df24f16b057f352bfd52e2966c0d2a8ffba77b73119937df0b158e1e7a4360d9310ba424510c8faa5f2cbe9854374faa9a08b44660fa5d38728e268a48d6b582568b892af90c7e43cab4c44c3f51f9016a60edc8bca209db20eff66991c78eb2777ee303836683aa6a5b36a1f2013891812fdc2113e633eeaf53487d117d81e081ae39d2345d0184bfd7bf2af5456566ed44f5f7924a20e768a440101e3ce53b5771ac54429800533f457f6c0bf41e28e187cf065a5de7e617710f93e5cfa342e8a14cfbfb3a4cb349b77f7e14beee1461512d8646ac0a7b4f29daa17ad4ed7f84884d0cd9934b1df1f04642453850eb59b11127d6928d9b0decf386b10477569062fa04ff28abd6936ca10eef1bbb05cba3dd1fec1ab0bda5fca6ba615853fea5ca44c7a7c4ac247ca95cca5433f56d171c9127fa423e288503266681747bde22d9f2a7be9fe8f8f3d20ba2492621e023db4e2dd126f8204e17bc8bd223a2d9c95349443ed3db3ab4848a57ffd65037b76fdbda16ba59c01667fef5011fd5dab37f92c53fcf3929c510ecb182bafa757d35dcd521862f36373a128959122612dd95cbcdf3efc1d45486acca361412adec3fdb3b32f827d2b100efca65852fa6eedc6abe846203b7e4be52f719609314e9f1048f3babaa19f14e064a7fca7bf29e5f316a31f6469f9f2d84de431747527d600a9d18cd38499522ebe774026f48359e2e63e9017f0288b9bab652e81412c9a3dc42db7298e57a5ee1d847595af8629dcc4622cb6d755e69fc4168c81262b3f7ef803ed01aed153c224d1d530a73f95ea882db65105c7a07d889452710453558ada8982b2a1e4ed9518b64107ff1052536539d0652e58320be18890ca39e7144d66add66b2d64042a2f4ab50bf91435b943ce69664b8fcd4f0532c50ca7fd377b5f3bf8cf7bba7fb9b3598484d50f0f660d5d19fd9f9fafb8641db42238073cb5e887ffdbae2c44af04e91c4d68a1cdf335e91c692823de7b2e1dbae16a0c6cafd7e94c850b30b2d2b7474ab5124c313d348dc3d3059f1a0690b8fd53159379446d3a452ddbf33df3d931b2842aec419c45d352910679f149ee7eb923b40dff4a478b1c0e78683985d9076063b0cb4069fc77d2835d29cf9dcf697357dbc59902412f22d36bc9f291b6726464796fb00f4c91389fe0cdd5b7e77856e4e64351a767f1569001e397d8e899dbc8da0a83f5dacd14401cd8affd830971f163ba4e235226e5dc408e229eb1f70dd0b4958c60c7e2f798b3f8fad1cf72890bdc6bdd4738e7f14cee9bc133b81c7a82eed49c62f7483a885fb9db39dd46bba28713c4f24320cc9c01811b78768658e1bece3bd0f8d6c4b386f774ea2e014e1fc8df9e8a94a18fb96b8fa2cecb401a178da1059803d4dcde215c3f7eebe3f7f10ce6a9ff8f4df0b7367940439b22da5f81eff03624ab376373245e0a963b72dd63ede9f5507455cfbd1687edef46d1b492a2d3ab338eac578cc34e68f6701192b14fdc885cb7327422710a3345cc103280c1b8afa661948bcd5da14075e7e6d98b507059e1d964bc3932fb942f279e4b68402538e6f70946b88d7f433d171a1cf47547472391f6a298c2c6cd81f99f20788d9713857eddbc32272de6b43d7934fcf3148464b5e3a66906bb1ea2a5a3314b71556575ef38f6148e194ac80b8d7ed6445f77eb79fbdb6d4c4ef3ef1f4ebbb2d967292c1485fbf5348cfc01075192c9d31ba17ecf41f2178b21a334e40c4834fd98e159fd07db4838dfa701904cc115c51d65d4fca35799a016f2d76f67cd001c4cb75ca94b8f56e632a56050441366bda4d9bd2486e68fb8d362f4b388da7e30e01edf6cde7ef39c91b60baa283bc0fe51ab947f14b8873e9605b0402623dee38d1016208a37133d789aec421f26c6fa0625eaeb8e6f7f0b517b72286c10c5cdecb52c346a6b352a7be913e94b5358678a6dc3020681aff112594b9e7bcbe734de44bef51553cc67609636f5507ae51190d942a852488625b8e45819a2f2a4ac0361159c55c4733fbda297f8898a749c19bd56cb7f39daab6602e4a3d368895939394400ba17b31c4ad2fd6111b27501fdb95011f1c58918d23df40fd706285534e3847667f4ea125cf016bdefe8b31145d1c84a4af6760a6c97c47b133b96b12714ae0e84031074daf3399311eee0c50e90d728464d10725ea92cb93203e1a28e9daf81d70ddd03a2026342d350ba1dbb75bf6f26490e956a5df626c2b6ddc697547f715d3514c7bc82e9a732330a88e21c5e06d7c1b1548014bdc6a1a115b6302ad1214f0193de15e8b6e405cffdaec33d2a81042781bd186b30e49dddf52b13bdfc70599245fe5a09ca5c302d1bc4bd3bfbf06938c5d79ba5624727d13c9ec1363ad6341fa628662ecc3ff32d431405e53a7a588ef76fd4edca3543f2cb99d4ffb45f1237c659efa41affc0c7ddd1a15ccb3ba252d97ae9cccb9d82893f0d1483382dcd23ecb7ff877b6d43d3fa3dda9898681cd1faa530fe96baee3b5a0876bbc001405e84905534a352faea7ff629128daaeaf1505f68ca13874fc4c848ee3aa55c233b819c6e5fb07d4bfcd6fd440d6cf074ef98fea7d6e6708a074e52ff1473c74a6e82ed3d6bee43e8d77bfa2c6b5023c9f6d62ab994f15075324f563f3fc6a9962ea7e4f9e16501da085fba90ed4e5707deb96740099b3fbe8400ddcda2a90800f7c31373231658205edc47d6a73c1028e1d1dc040a49f1800f10a8d4d45b86287d753d7287e7826dedcc42c4ab22c946b42af7a3d856384fb8fa30c93119a5e58eb87359e8d615899c5a56079802bbe1c229d9b23a4295caa8fcbc155f52e18f6fb939101fc11c17689bcfe6562b8b765348a59b58a01d60e77ffe9eef34ed2c9011b847c8f7204562d774c5cd873f3a1a09eb9339d877ba8344b82f6e1248c19e0d9a31662b2439c4c5c5023f4b9622ad5354da636e878474510ae0c884d4e55e01f5efbe93d5593e189423c85fbdbdc179ef8502e7027e7e89a20fdb7ad526da6bb11ef328033f55f85ee716670cf6a7a0068d269a9704bcaaed583f6f2664e4e25c69a44c6e8f78a2bb538c12d0520e8d2d716a49d90ffe25739b55199a463da88e5eedb27b248a98f3c533da3247dad2f6512f4e892383a4fc6c95cd71cad99240df5abc5c074c67be6df3b31ecd674bd1df89cc73f37fc76d1303095b4e27c083e27c9673c2e56cbaf71150bc19544755de7266e8ee54065d05212d5faa1c7bafd36797944ba4fc84e3d96a8d7c24ffe6a611fd3b1210fcac737a2d9a770174f990ad38983e9855e515fba9b59a9b18f766fc03adae78d2da483a6d18ba0f6452db56d0b25a7eb12ba37830a0a6e00432f485788211b3468e50e4c9a01b4152ce232954e1ecfd74b3b59d8565c67739d37b327a77c7079de6988c738b4778440f663da4e693dab9effbc430e315fde389324f15d775decba2d0c6545d3fd5fccb995fad31b08af951dfec79e2911d6862234f3e27ae74e1d8328bdc7161efbeccd7b6312892823e34eabbecd44f8441d34a7a997be1082a356017fcb315907bbef4f6e2edd1d0c69e155014313d1f03c48e2c6e1783d28d418e5297783a8e91badcc6f4d4d6ba96cb0827ea7314d5131f872aa0e64c46d4c5b5fd7f501b349859ce7d2787d76c66044576350e5da1db2733d34202413b546a4568dc382554d5281628191b164a48b93074c6e36c02b4ffaa7c74319ada7c501bd7665d31b8994cfaeba5bee5e8270c5bd82404bb252de508fca00f6530b6a421c8e54704d4116a39a656b43c8dcd9f26e42395389bcc1f72d4c4285be5e59ab77f99164217f2d348c5256e158d72ef6a2f83111eb8c482cd80622bb03a2c082d5ac19fbcfcce87554b537d7da7d3c9ee9a97d31802f54bf2724e35e43d70967359e251b932e0ab7897e829f484c47dc273e84ec2a2beec283ecff1ebf64362f42eeb5a6fe5ae62b240a892a21bc652746985df520c84e3ea2a5018587ab60360d699b54da615f27a4387a832b40442b9681b4cb7660577e39af01b069fd97a074ed184361d24bda4ca4604e8adf64c7c9524f58c6da9b49b7d11076f1da74eda5dd371ffe8b188674210bfd5965e5f298665e282319e3f5ef827b8cee1959b8788729c062f1ebd924094dfa7ba16cca0ca7e7fe21ccb78673d54052d0e6715da93fddda59deea87543871fa60c118913e8203ff64749e659c04736215c1bc3d333d09e527187e8ab21614e2825eee2a5b2bf8817f6d049b9d0c31a851b8d6c556225df4b5d115b889659e2109e2c6b5ba43df74f9dbb13fa8d6e5d07bf26954316d02723be6e574cd670807ce448234e6d107c77d748d1b2f068570783f3f8de51dbe7ce10d85c9a1b53e39a96afa1be4dabe9398e7a606d13bf68b05de9655ab51c31dc3325fa6dc688c2ebcc3eeecb1c800fa33ae2b3e912e1cad775ee849f130e5f841e28867b9051e7c105e8b075c4d1e846130839b207285d05aa5c145da8d680171a8a6cbc867fff2435e6db11bc97d03de1565190d443d61bfc255b347c03a4d4b845e1a180586a4f75c79889a1766adf599c9925e97422fa225c2d61794551f7909443d2ff7f2c1f4969779bf7388bc380568fe44b30c77fdfc90faa8afac45c28600aef1084ffa852bbb45078f85e7a187c84304dbeb4c7f638e4ebf5ba800e417103d820fb84ea7aae90c4c627efe0e7413bd7ae0121baa8ed757e100dcd79455f9d1d056de5feda4ce2927525f3e9c45ccacee85038200a2d23faa09f651b1a39f2f7553cb3ed74daabd84204ded49b204e393cb773b92f2e321cb676f0f5529c94f492a483e69dc863ee24f2616b090112b0cca8a962780849860f791e8f5c06827d39af5b1209ec157d78f58ee71d926d07ada1859efeb0ed2ae340cdee629efa1bd7d92b831149a1f0597290127d6de15fb287c788f7c3a1f65d12765291e104db36a84ab8588286b3c65cc78296cff23cf9b74e0eb5e5f0ff0d933ebae13de9d0792ad88295ab69da290adde027a1c8474415b10d0f6896474e559dfb69c0f1c8b86d65c0d97f4bcc0b35b1c85828cac420571de1063d82c494657a6067d0ec5d39fd2a46a88b92283d9824c4498f186ee020f2018c46a245b8557150fb20e46128ca61d64d7689c73898ee02d72e348066b2447313091ec1a969289d42f26c24a9bc345802527da02d33eec83d234e845ce9ab07da96a6b4c90cc17243659c2e04af43401119c79631f8b3ac09bc73953ca25fb8fc6e47cb99aad1c10c18ff338f708c52dced7b09abf2e407d015880cfda1b1a17296e8b5ffb8f7ae3a03e871b09948cc70a73966c745588a5acb940b0393aef4156ddf2f894774e20c038c78bbf9db84f490f6ad97ddd1201033cebd134f45d5a7f0e0e6ddcdde95260843489faf6527d5a8f137beb835f69802e6da3cda67871d06e0c5115c2d415c9cfbc9444d76674a7dd87afd2028fab7f7b4388e007c0910b8361d2201f44d24547f29f2dfc845bc40971b3d16cf89cc80513120dc92570f31617e82b9a73073db07557cea9dbe22a4cee5e9994910de7dca1b25ca77dd4578d08dadfbac3427db4153f242e78653bd291cdabdf585ce0e34847f3cd04e6e341468359613cee6fcb4c9d2f08fd493a84789cf787e6ce15b513ceb0329bb800f0931809be736a365091bb180884f69d5840ca7602400b04db4b41a5afbc1d5b92d48dfe5d4b590dc48cdba5ea6b7e12aeb5824172e92747a0a3a1a4197da34e2badaee64cb33bf0b4ea6973ed2571e49e039596de05c020867f5cf66375ceb779e4f49340ac7d89cdd1c838793c00aa3b9a622d9dfc3114ed8f480925c2c4c3b7de60e3bda0a38a0c72d62668311b57a925f27ffe21befec9bc33fa4edd8ad5387e570da12394abe48099e859d6bd65bfd6db33381ff583ea027ac99cca3fca568634a63fab1e0cbdb031950102068d7a00e25d2bff6c340492173e54374ccf602e2714b0ef1a6b2705c4fe0131dc4f7fb4c002499eafc1a7d1a7c1764a2deb169f0f3f816c05f4e7ffbf9205b2c0efeaf37646e63245af2ea66045d8762e5108a4e1869d268664c7bb8645e9b0dda9c505f419291de71047285701a17a22628f68502f5d93bab74ae9aaaa69374c7afec65ccd26c9c4848174c4848e044ed06fee0f2501c1a5fea7a188f1833a80425dd6594a2be65936ca7e1b0317ba82de9d243ed97bbecc69ec793ed5c1651bc42e814c4df5beb3d075edb7ca83c2a0195", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="c4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000edff2cbd7000fcdbdf25e1ffffff", @ANYRES32=0x0, @ANYBLOB="00000000000200001c00128009000100626f6e64000000000c000280080005"], 0x3c}, 0x1, 0x8100, 0x0, 0x40041}, 0x1800c85c) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000080)={0x29, 0x4, 0x0, {0x1, 0x8, 0x1, 0x0, [0x0]}}, 0x29) executing program 1: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x7c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x50, 0x3, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x40, 0xb, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_CMP_DATA={0x1c, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x15, 0x1, "e476027b9cb482f6f91bc95a3c0d803033"}]}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x100}}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a}) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000800)={@id={0x2, 0x0, @d}, 0x40, 0x0, '\x00', @a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file2\x00', 0x89801) move_mount(r2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x106) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000c000000000000000000008018110000", @ANYRES32, @ANYBLOB="00000000000000009c02000014000000b70300000000000055090100000000009500000000000000bf91000000000000b702bb480f2f01"], 0x0, 0xb, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0xffff}}, './file0\x00'}) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x6, @local, 0x1}]}, &(0x7f00000001c0)=0x10) (async) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) (async, rerun: 32) r4 = socket$inet_sctp(0x2, 0x1, 0x84) (rerun: 32) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000040)={r5}, 0x8) (async, rerun: 64) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={r5, 0x8, 0x1}, &(0x7f0000000100)=0xc) (async, rerun: 64) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00010000"], 0xdc) (async) ioctl$BTRFS_IOC_SNAP_DESTROY(r3, 0x5000940f, &(0x7f0000000400)={{r3}, "4c4afa22e8bcbf0c858822fa8d6e5851525bc97a4fd2b86b8af3ceb0c5d04463e6c5fa6413af7e46679c941c50270c95f1922e2028e3d7f7c672323e062dcf706e70e3c2e0c758a07e803cc75d06d935d2ad7853f875505947d74a9d579015b9fefbb407cced965fc281a47021dda7a21a8e397f911e7b2dee91b7dc93a445090ec9c303b9bcda12fb2f9cb41896f3750e4ec754f3411510419496b6197278c401789a71a44a55b7c0cf29144bfba6ac8d5524f891456bd3c910e3d318bddd662c8853482aebcd0b73291dcc931987096e9b76e38d556325b8de75c799743f2d3cbf602d6f7f6d926a52a841a509511dd19d866023fdd1c0ff5cc28e61aa914e2829f29454b8f04601b13bc819e81b65294ef06eec2b283d6832eac22779d96e390c5adfd54ccf81a45887cee6df1a0f98437f2b6a169999c1f3d7f8e534d13ea8f2d74fe0e8e39876015d3f53cd5182c53aa4742aa945c8effed7efe9100db94ade88ccea88e3b217b4a9a36eb8b0d29104281ef2836acc70d13923726eecf47d770755cd4012747a14ba0da0b4a1186bef73941b8bb4ad4e5ab26557ae2fa14301a5b72b92b368ee4dbc2f96141c22b7cb6f845a623f4590007a3716cef22871fd1d92750bea0e0870a182ccf709244e9ea40dad130772778fd53d859f7efa34a50d92c3052564c01403320f4ab5fb1e1483d850f7a8baa4b4f8fc933329a342e1a607046f225c1fbc8b6ba4298957af0fa264945d3ae05e1d5b98e9c3a819133cdea9f03e9bfe527637f728859d63e1b205048d9bd3bd5283c82f636bae8656c2e796034dfa24676b62fa79799669c656082ce0d59c5476860100573f339dcdc05d8d30e9b5ca5012f9655e41615f151458d89fa2f36da6e6646e73b21b97988c693cce71cad26805ed8a4b7f04dd86ac983038a537d9e6ac52c03b70250f894eb2545b732c332e8a21106c30e4014ebc549d2c7becfb3f38ea13bfabce1b1d6bd33c72f0c202c735709c15be710db6aa7daeb0f039d9a0bf4c3527120018ed12a15dc9872503a11343eed478148d48fbf900d3d81567f857ca1ca5870eb673b9852823a6ae6989cec844f83ae0b7f866da384d7043eb6d0390a429818fb6df0358cd506268ad0a7beaeeb271cc16b4891f6cff536354dcc83dd06b68b2d92242df7583fa2e3e0ffbc46d39b4887f24dd230a94d40df9802af9c4a40ac8bf92b8ea5de5d11b9d05b14e1be872a45decbd2e4ab859261efd3bd420de37b09a6b70f32e256f2398c62eb44b4d8dc2b4da17b8d352680a8bc640fdd2bf1cbeaccf5efc78181c3eaeda44eca68d8cf3ea4a2ec3dcfda03c1b32067a0a207ae92ee0d7893f25102e03afe9db58cb707e6020468ac6bfdcbd32d30159e30a01b3ef85bd004beec364b3ed5acdede9c82a6b0860a6bde97e35735e54799a9c0319588eeeb32493874104b4b4866031c2a9c682e33de08a62ec3f690306df12ea6251b516f84f43377f4b5c0f855c9b33a5de54831006e057d4e03ce0b96f8e316b00bbc21ce37124b72369e0fb4d1b2163d1eda61a306d2cb4d3f208f758a16358ca61cbe4277ab6312db60c969eed2d6178cf351c7fba1fb17aba614a38de908cb79acb661f88535778953432fda57b9b914d717480c9f92d761b8e5d17b6fc141976c1aebb204d8c72f7283a774c56858402d88adc4eb470b434dc4443e5c12ac0aba8bbf3c5b36a8d2d2b6bd84c82d9ff4238af28e2197ed4e914574f0be60716ec898258378aaf2637c08ca4630ede399b1ded38f1269c4b60401a085d0ed8b4babab5023115b263fe8064e5cb80056814e38be09f7f82803d9ec8460c00ddc6325520afd14c65b475daa01b9e83f719fc33c4a9407c101f0ba945ad6e9b4b93f0f5e0da8e055b76f380ce8de8a3beb4fbb4c3efbc878bb07b33fda0d429d7d78a73cf3dd71c953ea1bb4cf092811b50303c033197bea29f3047b0c0207ce3407c27026de223cdbbf5a550fdaaaaa64041b9386572eca83441d3059e655855bed42ce7f87bf7373d71e0fc97cc3f7c39f69acc42902e460d9df1ecde811516183ced3570ad6a51766683f72cb68a1e177dd9f2734decd167c8024b4a10fc1c456f3567d49806b244039d60a5dcce9ae22ea45cd5c14215756635934bc021bbae98979606552fd4778f4de6a79550f923e27d97b2a26d31e46a788b855fb5afe53f9d22b1f0ce83326a19f793b78a60fd0dbc1be08c8e7f38b5cebeaa1c51737cd6fc7fb36ca530fd79d8962e76990753f397b3c959c379bacb6c1b6a9102fb4da3aed85777fd8b3f6502942e627df059bbc75359a0c35bff42a79b5fdaf5d3d067298c47681609feaeb6a34cf4c65b38c38d2ee3c5b703099baf15de2e15ab62035d9caa8a2a1011143c2020bfc82a4364ef5d542430ca2a4569389dfa240ade04dbc147f9c25bfd19338fd90ce38ee54d596df08f5ee40cd7b0bcd5bd4241b8e2e4f87bc7a465669cfbfff1c6ab8e69b7e3b630cdc57cced361b517a2f0e711a4dd607c224eb50d9ea0addfa145a6be862274e5bbc6e40853d490cc69bf11a4cb9e715d650dfa5f0fd550d80739b4f21eeec604cb6fa26d46c168037abfa14d878f15526a3bb5b6f9417221b9fb8b0e9ac43570da08f1913d93e1f43d4e4ec10ea899e4df0b27773a2f52e6eb966a0f302e8f78d6f97ec8de2d48a02f404422aedb7725a60577d1d9e2c239e2d20ed0042cd2cdc3783614a7f36312e740594c2ea467bce9202df78a693cfd81edcaa616c64d593115da8b4511dcf44a97a0b4b7342d3471ba6f6ce69259cb1f15753b1a080c59059b618b44caf4af56f0240a0d50c64f145c1adab227ae6680648383721b4a6b6770d8a639a29965491c6963969fdb32280502eeaed0f881561e2adeab7120f1aa695b52fe8b7f2ef5b75ee2abbc92214f0d3c4a8b4a01475687d68f7ebd11be493775c3625a2060d5247f242885c35e0b7db4a60ba66744d115a1cff2e365d69480b11bec8c8d324275a923a631cb8ba0ae7f81de243b76453772313fa55b3c5110ef91f0c5b5b19b9b7ca9ad53e07f465a2be8e2d5c1002a903e52decabb03b3253e2d9f978ddf8b564fe5cc83df3e72f476afed3e22daacef934de3e16dc17f62dbf964a5d4ceff7d3b6d55ef1dc456bd553f8dd9403f723bf05b7c0b8dcdf8ccb9b11381f134c0f3e6dc64a64f75700f9a1042e816e875b228e8973b338b061766b589c706dd7c2bc687e10fc5d4957781ede259c2592e735fce52f4f30062f2304858e76ef3a661fd2fb96db819b4066775868d648b12839dab3c19ad2280331a14fb4820be8a9840b9737739d963ae9e11be614ce60b648e3708deb69123874c8707c0be0935b92645ac536088244a8d4fbc996c2e78e93330461a16875184b7d2556ff0a43557db3dcfb002c1494c70ff67409dbceb508d9a987358abeee9c772aa4ad83bbfcbdec5e1f31c253f68dc376f11b847da1664eaaa02f4b9466485b343ce336028fab1a2f67dc54dcca6da1528b68cc064698d6c9ce468f4bed485346dd67a7080b75d9f37f43034d3709e9394d6bbd406cec3eb08377313eda6234104a6fbfe28cffe578cfff71cac340ef01fc6c488cb46d2dd4d2e68f6ea7003c7ffbf4e0df0ce2817027f2864bbd15e16dbb1b28d081b9c1738c6c7beb41692ac3f7a3dbb7b368daafc0368c17f9b0dcc3ca9aea1230e1bb3d4bee2a04a3b54d7b357c7950274c724d6e410de972676fa57004214286097d2b6cc450bf17f9c8bda3bc861e6d7cbdfedd93c65948dcf431d56b6462c0ce65afbe16f4bf8be0fd25a87a073e06a74b5205cd16329a290d319128faa51609bd1a947cab1a5f084c9c4fc44fbbc84390b1b758d9568c6e563d77e4479979a2cf04751b9175ebc38cadbde68275be0133ac07d64af4feabc68092ed6a400be093c69f2f8e459119d3d2a21b5462a56b4906fe875e608635611802780a7eebc1ce238fac0777f872d7296f394c40606b428cc6bf3bfb340af90a03fffc048e02aa522904d213175837298cce57381eff701be873b38cd4e26d4955663b36ea41e24e6308e6fd8e550979342872acde995fcc299937818cb28373176b0f50962421918c9e473d1c76ecee2c6f3e876258f51406fe6f91158f522183fc7dbe4838208f89afbbd99afa2ca8b3e1541de6dc55ad134bbd2fa96d0cd34a66dacd76fa17c94d6eef5eb752a9794d71bc46378a6482409cfeefb323f4162312bbde4efb5802532fcde1a1f993ad2c8237ad073d8fba14a130263cebb9f0b799a5378e87bacad18285399175c67b2e26a9670de84eb308618374d35480d4ee368905d8f405e9263a2bc4a8d1799dfb487a9a29f5e1260fe478c1e5a9d562922b4f92d9373510d3560b19339741d671bb07f78a680619a53c42091cf08174853a1ec4244da0038329b28dff1902b7a90548b826dfbab23de4d3ba3e7d66f5d58cb52719fc6e32b2b8f7ee81b9327f78084a1c332794599412ea0452fdd497f9453fc04123dc717082e9b0fa305349d56fb4211722e7f0b615c7b58a67bde7439df3850fa209918b4d5050e4f6e8425fb3c70219e937860a5b4851b61708298d6ec4424fb4a5d156914c06e98be1a7c2b921294b0cfa2596298916ce962b691890e4f86b6cdd4dd11960cc173a01526acec7bbeed9e9b087f7c52f629ea7679418cbcf70bb02d32fa38bd27d2fe0d0a93df2415979a5cd320f90a8230f0ef17242d1f44ce90a6641915a5485624783491490fd941ce33ce72e4af9c50a17e4c3ebfb03e81e2ea5492371d312f0d3338fe9acb43f6d449e8ad19a38c35021153fb3842489e5033a5e455cdc3d15a6c63f11cd15826c8934f1fea43be98ac3467f741cd82edd89cd5e6626015c8a276166507d4ebfc13fc4f5240fbe936789a8a000969e6309715b09ad03460a83d0f21fb64ac21e6f6e333ac2cedd13787a0fbd6f046d264b8ac414518854c8a3052488bbf626ab44c8bcdfb62261963bbd7594306779517b9c73d551f31400eb4edf5a6cbedbc4c109f0898e391a39140d4bb9358c3ea60693271f77468c821c17e4d9506f0349e54d43701e934f06713613e3551c414cb17c08ed0ff132a1b6bc3b73b9efd921cca32f1781c797304f530f1cfe5c2f855ed7b4cf7c57dc7f8b85360b7d4308fc36d13706cc984537a3c5b16a18ff75b845467ad8b696431a4cfe2c5dba4dbe2a7b1b031ed7073276028848e17eb4a65cb77d5c8afd17e7c32b5134f1776b973024f72ef9906f4301ddfeac9b7524919c6fc4b2feb7b1fed7a61f32adf8c8bd6e2dbbbf3fdd6741c37189b67ed4dd64ce8ca220ec22a1408645f7e207f77b3794ba952ee70e55eb52ad4b0e79c87c475a87b6493fb9672ca1e98582d558618eac497c42899d077d7bced2827d5de1be7dde62953dd9df2e0121666cff8047a627ed8cad7267c90c939a359553ad92bec7ffb693e4cc257ccaf828f8dd147e575e36d702226626bfd8cd2fc4cc68a25b35ff1a7438884deec141a1bdcdd4ba4af96f0f6fbc84abca6b16f3195ed73cb3c3ff19f0da929f156528746eff6c5a48ff6e02887a696ec942193e706f2fae8aa734d16ca4793b9ca4cd85c16d827c48b33ff4647ad5f6dcf1eb101510ec8b53b56eca30427b738233d5118e964839640ee10e5f9488e0755f08cb5ee6322d42a2615819f48ca994677a37c8d83bea6fc147b1941f906e8acb498c676624df9a151e87e3851d0fb2657a0ea"}) executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3, 0x11, r1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) lseek(r0, 0x1000000, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000000c0)=@buf={0x21, &(0x7f0000000080)="a3d96f261462f91869c0450447314bbc2784e22ec7ea4179c203adcf339ac57fde"}) executing program 1: r0 = socket$inet(0x2, 0x4000000000000006, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @multicast2}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) connect$inet(r0, &(0x7f0000001040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) executing program 2: ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000000)={0x1, 0x80000, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x50}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x64}, 0x1, 0x0, 0x0, 0x41}, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_NOACK_MAP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3, 0x6b}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x4}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x8}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x7}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x81}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x40}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x81}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x28040810}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f0000000380)=0xb, 0x4) sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x8c, r1, 0x4, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x48, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "f7097f151e"}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x18, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fdd19409c0"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a237643dc2"}]}, 0x8c}}, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000540)=r0) syz_ublk_setup_io_uring(0x2abe, &(0x7f0000000580)={0x0, 0x3f33, 0x400, 0x3, 0x3e8, 0x0, r0}, &(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680)) fremovexattr(r5, &(0x7f00000006c0)=@known='trusted.syz\x00') sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x885}, 0x20008014) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000840), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x7c, r6, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x8}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x7c}, 0x1, 0x0, 0x0, 0xc004}, 0x40004) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x80c4}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x14, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x800) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000a80), 0x241000, 0x0) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000ac0)={0x41, 0x0, 0x1}, 0x10) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000b00)=""/235) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000c00)={"09f636fe", 0xbe, 0xc, 0x20, 0xffff0000, 0x7fff, "3e09d3af5a0503cdcb8f2669a865be", "a70df515", "f1b0571e", "3858c548", ["0d027c516659898f69ea0d81", "d0e6b18081296a9746b90c16", "39218bba00c95606c4a65116", "27cbc8a397f4e0370af7aa75"]}) keyctl$get_security(0x11, 0x0, &(0x7f0000000c80)=""/153, 0x99) sendmsg$SEG6_CMD_SETHMAC(r7, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x1c, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c0c0}, 0x4000000) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r0, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x14, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}}, 0x20000000) r9 = request_key(&(0x7f0000000f40)='big_key\x00', &(0x7f0000000f80)={'syz', 0x1}, &(0x7f0000000fc0)='\x00', 0xfffffffffffffffe) r10 = add_key$keyring(&(0x7f0000001040), &(0x7f0000001080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate(0xc, r9, &(0x7f0000001000)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'trusted:', '}.,{*$'}, 0x1f, r10) sendmsg(r4, &(0x7f0000002480)={&(0x7f00000010c0)=@isdn={0x22, 0xd, 0xa, 0x3, 0xb}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001140)="8766001e519cb7ee4f794fac17a761d338ea7536afc7980343f271ce75afe58f2487c3eb5552dc7936091802588c5ea19c1380488a54efb23efa029473d461c65cb6b8f9a44eb3ab0aa3a773cf59f4835c6c31aff950a7256b98e68d78baeb1b2c9725ecdc5d4ac0b64d6045b92bd89cd2a2f0e88b126ec2dddf2375a84d83a60f4e1efc581978cb04bcf48984f8e23041f49b1fba64340ec72eedb760c83d096a3622b3de09870de915bb7e4b31ed8997f4d71a33cf8339295450b27ece71be9fd9476f3021a1f636491e1bc69878677f4934da9ac89125cae26355e61a6241d31d1a2afa1fbdf98a2ac86a0b0b82c5062d23b426a42bd05bebd90462", 0xfd}, {&(0x7f0000001240)="0056b9b5bbd098b5b54ac72ed5cd124e7392d3b09c65b8e4cce95bba374dbbbd33212f7911499e19034838b6aeabe781e071de928d072d17025efee6b6c9e36b954f55e56ec56a9fa9d965abe25589ba09db18269edf3fe8435e29f8a1aee5afd89c384c148873e4461d73233d62dd20672ed4e8d19afca859598ab5845898c65908b7eec485e7531c519b67e253c12904596b68f77d36bbed9f8a4407303ccbeadac07cc31c610cfd7aa479e03c87322887db72891d6f4f2ed23cccecbc8563df94e12b67af", 0xc6}, {&(0x7f0000001340)}, {&(0x7f0000001380)="5ecbc441437f08a460d8bc66e1c99718a96a8257e0417414ed32a12c6ec7b50cd0", 0x21}, {&(0x7f00000013c0)="1dbc964f6a3bb359a47895cc6ec6646dc97205ed349202f0faa4c142b6b30a5b666191c59c76a7ef2379f23fe1df1403bd052eba7f522298cbcf681c93e9b6eecadc8c5f453aed1661ec2ad9a02cf9088e28794e843dd75df03c6aa4e4d677239916cafeb15ad71d72f77728c68552112109fa69c356ce8e61930a40a002811e9a4dd3e813ad8cb7d7b7ece9d323f102a72a192a3aae1332b2715ce242e3f934dada504242b338254d1ee50f3c431a1ddfbd520fb6ab29415e9513599dfbb498371c8ab9cc6a42cca4e3071c34cb57b3ca4d73b7d0d4de259d8f17f6f7c5585805cf7d6c3ed672473ba00bca6ee271d38f627b61bdd8a3c123d6531c118c9ac44b7b602e782141685a5c7f16d40e43599540707559f2489d6e5ff6e0fd5c4ffb61a08d39bdb8cc2b454a573f102871a934aed1c2e63d6cde394194b9d85946934cf2dfc9831077ec7a2e244e37f62b890be506867f033377412a5636e523f1ff35b1dd9ff3af0e3249ca41cc51a79c787a53cc85cf49108d673a254cf6d9d4c5a4f5b996ce7b3b9a77bc4d428d5bc0b440cac7e531b1c68f000f6e9a95baa5d17385bda73168c51690b15812ac254f8e8430bfbe07ad52e1ffb3cac864c6fe23f9f8e4f1eff5936da0878db40883aa8c3570689e42404f88ea1807447e11ebbee19e364452cc7d377f28459c4e8f8cb260bdbe41f226298e98d608ee1d300b762cfbca73dff4939161ad1a5a4c4e58859f0bf8234ad92e3ee3ffd65f525c406be070b3f993c9427770ab2be39d83c02f9042ccf4e827134ac1676cb60ad569b4283d53319aa3a44ea7d05a3e235ab027d4c006cdfc243ce6b4303bf48825554946a23571c2325cd7f0d6f6c5fc4a90bb723b9e1232f59f09d60a0cf87f5c0303d90c1868fb773933065a7a072c0adc91cad2af38e8f013076ae0d8e02c44498b91cc290c1f1ec8277c2be80fc78ec233faedd441e508c6b653fb553de82349e8a54e2f7119dfcac5d976dc914db6d71f2df361a747bd84f500abc82db789a244da09597b4bcff82640d601da68701392e9fbc871f365fe30a8db0b878048c4668cb1ff01f42a4b77ac7ee54432384eeb337f0a801f0836f2267406b85500e790a129c5c48d8da6d222ea1c0a2baa0f0bb9542783ce71efe00687a123a9f6dbc5ff0daf0bca5a6e4febcc31da987ba8f917a49e100a3d65c724faec6ccbbe1efca334ef7fee3d8d974334461002cb7eea8ab6188f630ad0cb37e6b7f4224b46f15bff745ccaff20e4532e491d20f10537b1aaceffa6685572749b145261729d2984aa9c324960dd8e358e2e0fd757ce55709753a80f53960951d361ce32b98ef8e4d78cc7f1f33b0f8094c7a7e5859bc43b72d3feba296d3200fec2d26a227c7b15e78a2f238358fcb14ded5689773ee20ea1ef8a2d125ff935ae7196950d418718a7a3fad9b87c8fe100eeb7adcfd748974c7007ae470c4a2a7646490a305c47e31871fa76b275d67ab4290e3c008d1d0009c70705dd1590ea2a2f9b1c1769f1a9ef997a4f4ba96e084b24f0b235a83c82bd4fa131f4e80725f3bb4f0aa4f1d5f4e1187d059dcfc6743f5438ba2343bd079b5839591d7c70971993996c43375f5a3db0ac58a682407763ca5477e27bd63328f35c84de49e24cbfe454f289a62e7404dc68a34ab7fd43ceda38ac129a72e98a779857854792be7183b7352ca114f7a60915db6c2b86df48985d18c275003383e9bebc90fc121a8c8c4703e88875d054dacf76f45d738c7b06eedd47b3474ec4207220378ac2dc8a2e199ad302cfaf38ae0fa9f639db241ebd392458403b74ece988029f6ecf8a373dd7dbf7b87c96c6bd8ae7790de5c106079400e150893b44c0b9b8fba8768242e2e098df446726598513d7fd035667ec04970b2faa52ec72608ce04d7b514a13d3a538769c35ed82be43cc7d6c95860b37ed87588f2555ff6237863c8ff53a7bf8aa39a1b3e5e6cd60e6c6fff09f5bb324bf437c4ef0b482c07e1e478688c81886734a53a87ae4e233beb7f22d34ae7d9a7dcf9b83bdd31315e6a60811dbf72f3aa5f6cb0e3da7d90a66d5e41d8ac605828682b3172bcb10356d20ab38626d963cbba95eb3d1ffa8dfb3bddd75504064aaac39091f3a209e548037cb67d10fa1cd67617b7038f1eaf769d3fec5c0510b9a06716928736702e0bd623fff8bae86ecf0f3b250251300b4da7c3dafee6352de225d77bbf4ee6ac478b354ab0ee484d972b67c5d6570c574e33c10f759c36f996b58d7c1530915e4b32536f63904d9829aa44db6c2fa8f6c3a455cdd5d5239ca81740fbf33815e896d8bd9c7960bcc55421de3a0733dc6fad9eafb1309aa648a34aac6beb4efadd565c3dc8fdbc98a4e40d6ac6df8e04dfc0fc9c7b68fd4ed0939a9f3902b38338465b3a0fa532769cca421c171789eeb911b8375ce861b4c68f5c93a8816d9ff1263845154b4a35a9eeecaba1371687bbc8e13a2ecafc537ebb49e2435e6f9f304639207bfc11025b89d36df38943ffc06f7caeec8aaa0e9d97a79fced5ac369824fef1a918431d5c2cf32127d201a7018bc2a8dc5dfd347e305b268b284a8fdbf716b794fc97bf09ae20be5ec8b48c9393b6d11c73889ea72b6b96ac3ab2a9038951bc6d3d4e4f288343e5ba6708cb7248da95f121b57c213a6f2e5892bafe4186fd9b32b67949011a6782c8c56fa3fe871e698be899d136155246e6ddbb7fe7fb2d49272954c8c442213ef2ee50d74c1ac62c733f7c7ce225a7080ff5a6b41dadc5d451801a2a79241b046287eadf67651e21f35805e5f5754fdb1e7c67801231758136b090213f6a2967c206fe339e5d96274f1af68c81ae16b19aac7f329f9dad59a2bb4c84cab3508469f19c92db2bc56bf3b6e3eaaa28838ba9c0ba755e2ac00dccac0d9db8ed04587399433cdd057330ca45789b35c4583493d48304fde386862f032760f038d646639b22c88b17d4fe0c9902e269cd3ec2a200c2a9d497106d4e3d6d95652d43129a2b59522f90b94e18625df7ef8f99d67cf0e736d7587cca8eac1a144b30658420a9c2b64be94ac89a28fba72b36e1d34207bc0bfb89cc592a7a30d768617d181d4dda02ce2bcc3cbec3604e6f79df9d54237fbf128e6e3590038d04968c7a72743f9ead77b1f393aa26b3b6d2906516f7aaadc3764022aaab5414db4a275389d24258d72da0d136b1d156d8c48a16855310f1db89ea9b6f24fba3ab709f18dd8118b15f038c3a18c29ffa2d18554299871d74c4e92655c511262d80b4fc34aa9333bf738706621cf63e50d42d0570ace9e1294463154a988c148b227a2260097bba6c4edddf1db5412b66a61c4a1b2994d33a531ec43840fa2dab5e6c3d3b324bf5f093095145fcf7e83c0b3d1cbd01f83651f1771e8262565b8fba24e2b0c1a87e97f8b29a0159288be08854a656f0bc6b299ebd52a0dfc531e7f5555be5409c06944f9fa25ad8dcb308d802d3f82952cfe6ed9c2fd82979fd0288d1a36f8a046ceef207fd145f57558fae4ef5bac3052f3de024655d365a236fb4c13a133dec574e9c4a84b9be9335355ae09c6e3a579dc230c24aea085016aa1b2af5c90973a3f84de650170e9ea16895c1179728d327cccefcd9609ba8dcca73413359b51161fcec39f748491d271c22f604d753170ab3c1a50c97a8cd866f904e466d42a3d814c791f94c89a382911cc090d3faa5eafcfbdc8b38c0609db021597cce751b2166057ed4202c07de185576ffb8d503066b4ecdd95f12a90585e4e8317530ab3b733ef6fa5f5cb7def6b57e8d2754963b8385dc4910305c4fece0b13aecca8bdf23b4b69240ad78d81441c2841e97416ea078e6b00f99064a587e0545e69244bc22167e456df09bc7f4f2187b79dc7afba3b65a74b7a2fb7169daeea489db6cd7e579c97f3df75f45ca9aebb30d654598633a2606ede428c40c9dbc6db48b782190905c8e87a8cbb0550984fa932d2cf3531acc4495a7121bb5ff223b9a0b5871d54480f06d0ab25c93ad03b65a515fbf25732c5c91e3ad21f2564a498ea9956fd1e1628633498a146f241a54dbc053a5b3aea23d686175572e11abd97e55135739f07816940b605abac886ac0645929fe64f2bd4994152356ecd41bb9a5c18b279f2553ff6455109d9a2fa68ee5f11d47fd6444192eb6142f170e7de86930ef27a5164f9fe615bc2e6092acc54719db6323278eee33adb2436807f0dc66a8d3201a9ca3cad07714245859ab257dec8a6ada92500b7b45c1b7219d4c93d224b02e456505bddd02edbf9ce7145a54646967692cc6a5f0329374b1ff6d103a96be9e802dc70dfca9731ac0f71a487175b6f1f2cb034b7f1a5de4936ace474978a1bf55b07d093fcfc91c9f4f4dd0e9f3a8651f9a9de26c73e221164e726f436b8ae5b6ff7e60b2518e27cd2f2b883d6376790a43c5c8e9350242f8a19e35e4f644be39a0eb94c0712edecff2932f2418ce02636d9e8a24ce82ade0c0bd05127b78f7c2036642db6687e5864d2191ea156cc742efeecd8b3dbb09a17f967bb9237369c11df80db466e025fb201bbd93c8dfbee56ecadca5eff0be43f85e9417fa303bbb116a91aeb18e379ad7037e2c960e880cf83194f560d07373dc70ff3031a4bd5a4a3846d6f8342d0e0a70c1dd36dde98c09f608c2a201bccbaf95e0021257a4b2d351d17c7db3d891da4156845180c52deb2ec19e604efafa1555836dbc37d759d722e2553b99ac051b226b0ff932dd24fdfbf739f6e666cb8998eb86b771ff01b68e7c5760d08cd0d17e48c39df1bd87176e5ca33e915703930a7340c07d7f7fd32b3f55a43b52db484bd008b42c756afde94605e22c8dd1f3ab34e5ab35234a72746e364a97bc7e1b25631a0d6dcf2a87cd847cae85ad4a2be50c2b41128bde6b5323652d83ad4b47cd5280f37eae54e5f37f2509d9c140b9b8010ec93b7fc667d80a92ab9b9d46aeb8c3ed41f8942e785afea6d1087b0cb690a83fb7bdaead5ff796e905fe6aa2196a56f14d78a1229e6366fdeb284c3b8cf2d9f2cc5e83ffdca8dd1e7ed1614e7875ddf9de757bcb40c1857e2fc01be081b7a7fe58719b61d0b6ff39b285a753a63bd370f726126aaae39d2816f3bb4a51aef590bf2778432abad9fa27b5824edfe3ec4ff01edb2cc85c7eafebd5828b3de2b9de813c72eb4f256a051659524e1ddc7be8f6b2704a821eaa59b289cfbdaa909549aa738126e8072816ceffcbdd1ec395278d1055bee854e0e2196bad0af08a69cea4f324cfa8e87fd60bd653dc75b32370a1bb1dcea4343c5968707c4fea7cb148c5b1b84e3f79b4f053e8a8b4d3e8dc1addcb9eed64f1fcd814587c5e04b3ca3e6539bb9894ba35652eb78ec82e487bbdac7f009e9c2d83d3a50ea0ea3894247a64b73abe1aab18cdde10246d574986a2d18b44f1cab84ecd0f3d1559ad0c8dd7291a308c36d26f370d665bf3e300e33d0de17e939364ab600925f883c4a56b0414b5815ca2f0ba965c4402c5ba138c2c6da8b4823a327d7cfbe38132e3bfe6fea694d0ae7e9ad9fc62c4665dcc93660b5e47695d1a10c3cb54115367a4a1493720cd0b486c6573e6f35e8eeae0169f8e7c88977f22df411efc35ca5575094a4c988d120c4c65ac41b2a53b7f89394e07c0627b3c3d058bbe6862d9e7e6e9f4e4ed203af0f9e389e194ba4cc59bba8566753b1cb638867e961ce0ba9c6008ce885000161061d3284670d1d7978368cdd8ac356342651937e4ebdb01b9ae3a73bcd0375e", 0x1000}], 0x5, &(0x7f0000002440)=[{0x28, 0x103, 0xd, "0b1fb299d122a6a050dd2559584fdd5152abc9"}], 0x28}, 0x60400a0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f00000024c0), &(0x7f0000002500)=0xc) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="4401000010000100fefff7ff00010023e0000001000000000000000000000000e0000002000000000000000000000000000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000ffffac1e0001000000000000000092010000000000003affffffffffffff00000000000000001c250800000000000200000000000000f8ffffffffffffff7c232e0e00000000090000000000000000000000000000001f00000002000000feffffffffffffff02000000fcffffffff0f00002abd700004350000020001000000000000000000480003"], 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0xff, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@report={0x6c, 0x20, 0x400, 0x70bd28, 0x25dfdbfd, {0x2b, {@in6=@empty, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e23, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x120, 0x2f, r3, r4}}, [@iptfs_init_delay={0x8, 0x27, 0x3b83}, @extra_flags={0x8, 0x18, 0xf4}, @tfcpad={0x8, 0x16, 0x6}, @proto={0x5, 0x19, 0xff}]}, 0x6c}}, 0x10) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x12, &(0x7f0000000bc0)=ANY=[@ANYBLOB="bf12000000000000b7030000000000007b3ac0ff000000007b3ac8ff000000007b3ad0ff000000007b3ad8ff000000007b3ae0ff000000007b3ae8ff000000007b3af0ff000000007b3af8ff00000000bf21000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f0000000800)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r5, 0x0, 0xe, 0x0, &(0x7f0000000a00)="0123456789abcdef0123456789ab", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000180)={0xd, @pix={0x200, 0x2, 0x32314241, 0x0, 0x0, 0x0, 0x3, 0xfeedcafe, 0x3, 0x0, 0x2, 0x1}}) executing program 2: prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) userfaultfd(0x80000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0, 0x180) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) r1 = openat(r0, &(0x7f0000000140)='./tracing\x00', 0x600381, 0x20) write$tcp_mem(r1, &(0x7f00000000c0)={0xffffffffffffffff, 0x20, 0x58}, 0x48) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c033, 0xffffffffffffffff, 0x0) write$ppp(r2, &(0x7f00000004c0)="852c9075", 0x4) move_pages(0x0, 0x1, &(0x7f0000000000)=[&(0x7f0000ffc000/0x1000)=nil], &(0x7f0000001180), 0xfffffffffffffffe, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x400000, &(0x7f00000000c0)={[{@noload}, {@abort}, {@data_err_ignore}, {@nogrpid}, {@oldalloc}, {@errors_remount}]}, 0x0, 0x467, &(0x7f0000000500)="$eJzs3M9vFFUcAPDvTLflt62KP0DQKhqJPwotPw9eMJp40MREDxhPtS0EWajSmgghWj3g0ZB4Nx5N/As86cWoJxOvejckxHABNSZjZna2XZbd0rVbFtjPJ1n2vZ23zPvuzJt5895MA+hbo/k/ScTmiPgtIoZr2esLjNberl05P/XXlfNTSWTZG38mRbmrV85P1YvWv7eplsmyMr+uxXovvB0xWa3OnCnze+ZPvbdn7uy550+cmjw+c3zm9MThw/v37Rw6OHGgK3HmcV3d/tHsjm2vvHXxtamjF9/56Zu8vpvL5Y1xdMmG0dqv29JTXV5Zr21pSCeVHlaEjgxERL65Bov2PxwDsWFx2XC8/GlPKwesqSzLslbn59JCBtzFkuh1DYDeqJ/o8+vf+usWdT1uC5ePRLx/qBb/tfJVW1KJtCwz2HR9202jEXF04e8v81eszTgEAMB1vjsSEc+16v+l8WBDuXvKOZSRiLg3Iu6LiPsjYmtEPBBRlH0oIh7ucP3NMyQ39n/SS/8rsBXK+38vlHNbi/2/f7Mi/tLIQJnbUsQ/mBw7UZ3ZW/4mu2NwXZ4fX2Yd37/06+ftluXxJwtLfcB8/fW+YE16qdI0QDc9OT+5yrAXXf4kYnulKf5CEvVpnCQitkXE9o7+56UrjBPPfL2jXanG/m/r+JfRhXmm7KuIp2vbfyGa4q9L2s5Pjh86OHFgz/qozuz9J8uyYq9YslC+//zLhdfbrX9V8XdBvv03Nu//hcX4R5L1EXNnz50s5mvnonmG+KYu/P5Z22uam8ffev8fSt4s0kPlZx9Ozs+fGY8YSl698fOJpe+W+Upj/Lt3tYo/LY5x9WgfiYh8J94ZEY9GxGNl3R+PiCciYtcy8f/44pPvdh7/MqPyNZ0ealvK45++2faPxu3feWLg5A/fdh5/Xb799xep3eUnKzn+rbSCq/ntAAAA4E6RFvfAJ+nYYjpNx8Zq9/BvjY1pdXZu/tljsx+cnq7dKz8Sg2l9/HO4YTx0vBwbrucnloZgivy+ctz4i4ENRX5sarY63ePYod9tatP+c38M9Lp2wJrzvBb0L+0f+pf2D/1L+4f+pf1D/2rV/j/uQT2AW8/5H/qX9g/9q6n9d/Z0J3BHc/6HvtT22fh0VY/8S9z1iUg7/1YlelrnpIM/DHH7JCprXed1LRf1+sgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHf8FAAD//4sz60A=") (async) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x400000, &(0x7f00000000c0)={[{@noload}, {@abort}, {@data_err_ignore}, {@nogrpid}, {@oldalloc}, {@errors_remount}]}, 0x0, 0x467, &(0x7f0000000500)="$eJzs3M9vFFUcAPDvTLflt62KP0DQKhqJPwotPw9eMJp40MREDxhPtS0EWajSmgghWj3g0ZB4Nx5N/As86cWoJxOvejckxHABNSZjZna2XZbd0rVbFtjPJ1n2vZ23zPvuzJt5895MA+hbo/k/ScTmiPgtIoZr2esLjNberl05P/XXlfNTSWTZG38mRbmrV85P1YvWv7eplsmyMr+uxXovvB0xWa3OnCnze+ZPvbdn7uy550+cmjw+c3zm9MThw/v37Rw6OHGgK3HmcV3d/tHsjm2vvHXxtamjF9/56Zu8vpvL5Y1xdMmG0dqv29JTXV5Zr21pSCeVHlaEjgxERL65Bov2PxwDsWFx2XC8/GlPKwesqSzLslbn59JCBtzFkuh1DYDeqJ/o8+vf+usWdT1uC5ePRLx/qBb/tfJVW1KJtCwz2HR9202jEXF04e8v81eszTgEAMB1vjsSEc+16v+l8WBDuXvKOZSRiLg3Iu6LiPsjYmtEPBBRlH0oIh7ucP3NMyQ39n/SS/8rsBXK+38vlHNbi/2/f7Mi/tLIQJnbUsQ/mBw7UZ3ZW/4mu2NwXZ4fX2Yd37/06+ftluXxJwtLfcB8/fW+YE16qdI0QDc9OT+5yrAXXf4kYnulKf5CEvVpnCQitkXE9o7+56UrjBPPfL2jXanG/m/r+JfRhXmm7KuIp2vbfyGa4q9L2s5Pjh86OHFgz/qozuz9J8uyYq9YslC+//zLhdfbrX9V8XdBvv03Nu//hcX4R5L1EXNnz50s5mvnonmG+KYu/P5Z22uam8ffev8fSt4s0kPlZx9Ozs+fGY8YSl698fOJpe+W+Upj/Lt3tYo/LY5x9WgfiYh8J94ZEY9GxGNl3R+PiCciYtcy8f/44pPvdh7/MqPyNZ0ealvK45++2faPxu3feWLg5A/fdh5/Xb799xep3eUnKzn+rbSCq/ntAAAA4E6RFvfAJ+nYYjpNx8Zq9/BvjY1pdXZu/tljsx+cnq7dKz8Sg2l9/HO4YTx0vBwbrucnloZgivy+ctz4i4ENRX5sarY63ePYod9tatP+c38M9Lp2wJrzvBb0L+0f+pf2D/1L+4f+pf1D/2rV/j/uQT2AW8/5H/qX9g/9q6n9d/Z0J3BHc/6HvtT22fh0VY/8S9z1iUg7/1YlelrnpIM/DHH7JCprXed1LRf1+sgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHf8FAAD//4sz60A=") mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) (async) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x2) r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) pselect6(0x40, &(0x7f0000003d00)={0x9, 0xe1c8, 0xffffffffffffff7f, 0x1000, 0x0, 0xf5, 0x40, 0xb08}, 0x0, 0x0, 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000003d00)={0x9, 0xe1c8, 0xffffffffffffff7f, 0x1000, 0x0, 0xf5, 0x40, 0xb08}, 0x0, 0x0, 0x0, 0x0) syz_read_part_table(0x61f, &(0x7f0000000cc0)="$eJzs0z2IHVUbB/D/mfu58L5skNhoMAvamsI0sViSRaME0V38KmzERhCsAhYWcm9ICittbI0IKcTCNGoV0UJ2BfFjtQkWIiHYWCmiCIGR+bjZC4rNLory+3GZOXOe554zw/Oc8C83Sl2XlaSUZJ5k9Y53kmFd17NkPuyTxvn22mTa5/fWkifefvT+xx7a2mhy+8kj/2vzy1JuyYmn28Fgb9d69Z7dNz+976f5/LM7v9oZdGlJrlTJ0eRkcnOqe61pBq9f+q7sTUJyeX179XxVTzJaf27cN9y9Zd7G6saslHZyuvSn4x/2TbV/g0VDlpKrD750/a7dE812VdP8O7u/7fVqM/o+izdZSXLrI+30IqU7QvP21Az+sM+4uTSn8VQzeK85rJMD+QD2pe2/C2fHHw3bylx94/C1Uqo2VKVqivprXZ/r63+jniZH15pQU2EFBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADtLl9e3V8dLz8WfvPn37q9WpVCX5spvKShc7l2SQ5PPSJ7/28IHsf/7C2ZVM+kVHScabP178/7EvdkbZvJhMk0NJE67aX2v6ZHsb7/sF+Ed19R/llRfXfxl1U9Mf+tgt33w8WxT45/F0dviFthHnbUt03l1aqpzcGy4Gkz/bU9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH/b6QfOrG1tVI8nVRlOk1SHLm23kXl7revktg+eeuv5Tza+HiTZnLyf5EbOlDxTL62zNenuV6pMciQ5Nmyexrn+8iJjcDO3NMvWs7/rE/kLvwcAAP//Qq9sdQ==") executing program 2: r0 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fd7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) (async) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fd7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$ENABLE_STATS(0x20, 0xffffffffffffffff, 0x0) getpid() (async) r2 = getpid() syz_pidfd_open(r2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYRESOCT=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x5}, 0x5, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYRESOCT=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x5}, 0x5, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r3, 0x702, 0xe, 0x0, &(0x7f0000000380)="e46057a4bf7c12f39d10ba334470", 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) (async) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) setsockopt$inet_group_source_req(r4, 0x0, 0x2e, &(0x7f00000006c0)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @multicast1}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local}, 0x1) getsockopt$inet_buf(r4, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x91) (async) getsockopt$inet_buf(r4, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x91) r5 = socket$inet6(0xa, 0x3, 0x88) r6 = socket(0x40000000015, 0x5, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0xa) (async) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0xa) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000980)={{{@in=@loopback, @in=@local, 0xee24, 0x0, 0x0, 0x3, 0x2}, {0x81000, 0x200000004, 0x40000000007, 0xffffffff, 0x100000000, 0x0, 0x200000003, 0x9}, {0x5}, 0x5, 0x6e6bb1, 0x1, 0x0, 0x0, 0x3}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x3501, 0x4, 0x8, 0x0, 0x9075, 0xef, 0x9}}, 0xe8) pread64(r5, &(0x7f0000000040)=""/164, 0xa4, 0x3) r7 = memfd_create(&(0x7f0000000600)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x80#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92\xc0~P\x1c\xf7\x9c\x8e\x87P\x8c\xfd\x81\xc6/\xbaV\x1f\xb1tH\xe2\xa3\xa1\xb6\x17\x19m\x16\xef)\x18\xb0\xe39\x91\xa7\x9e\r4', 0x3) fcntl$addseals(r7, 0x409, 0x8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000000, 0x13, r7, 0xeff74000) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x8}}, 0x7}, 0x1c) executing program 2: capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x0, 0xe, 0x80000000}) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) capset(&(0x7f0000000100)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000140)={0x40, 0xfff, 0x1, 0x1, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0100000001050a0000000000000000010000049800018006000340000200002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000022c00018014000300fc020000000000000000000000000000140004000000000000000000000000000000000106000340000200002c00018014000300fc00000000000000000000000000000114000400000000000000ffffac1414aa2c000d8014000500fe8000000000000000000000000000aa14000400fe8800000000000000000000000000013c00188008000240fffffffc080003400000080008000240000000030800034000000101080003400000000808000340000010000800014000006edb0600124000010000"], 0x11c}, 0x1, 0x0, 0x0, 0x4040001}, 0x801) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020731af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x9}, 0x94) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x30, 0x4}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000004c0)={0x1, 0xd, 0x800081}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x0, 0x2, 0xfffffffe}]}, 0x10) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x6, 0x0, 0x1, 0x7}, 0x14) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b032200eb1025120212475400903e3bb1000000080086dd4803", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000740)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000002}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xa8, 0x0, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@CTA_NAT_SRC={0x6c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1800}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0x1, 0x4aa, 0x2, 0xf, 0x5, 0x70, 0xd9b0]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$sock_netdev_private(r6, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x81, 0x7f, 0x9, 0xfffffff4}, {0x5, 0x8, 0x4e, 0x22}]}, 0x10) executing program 32: capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x0, 0xe, 0x80000000}) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) capset(&(0x7f0000000100)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000140)={0x40, 0xfff, 0x1, 0x1, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0100000001050a0000000000000000010000049800018006000340000200002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000022c00018014000300fc020000000000000000000000000000140004000000000000000000000000000000000106000340000200002c00018014000300fc00000000000000000000000000000114000400000000000000ffffac1414aa2c000d8014000500fe8000000000000000000000000000aa14000400fe8800000000000000000000000000013c00188008000240fffffffc080003400000080008000240000000030800034000000101080003400000000808000340000010000800014000006edb0600124000010000"], 0x11c}, 0x1, 0x0, 0x0, 0x4040001}, 0x801) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020731af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x9}, 0x94) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x30, 0x4}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000004c0)={0x1, 0xd, 0x800081}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x0, 0x2, 0xfffffffe}]}, 0x10) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x6, 0x0, 0x1, 0x7}, 0x14) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b032200eb1025120212475400903e3bb1000000080086dd4803", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000740)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000002}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xa8, 0x0, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@CTA_NAT_SRC={0x6c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1800}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0x1, 0x4aa, 0x2, 0xf, 0x5, 0x70, 0xd9b0]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$sock_netdev_private(r6, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x81, 0x7f, 0x9, 0xfffffff4}, {0x5, 0x8, 0x4e, 0x22}]}, 0x10) executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x4, 0x4}, {0x6, 0x0, 0xfe, 0x4}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x13b242, 0x12d) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd8, 0x453, 0x20, 0x70bd2c, 0x25dfdbfc, "30ecfab63baeaad8d58f5d7b664e4f263d5a2810a88ab4b88fe019ad78c0426c079e6f8b4488889c2097ed75fae6342855bf6361d773c2bb93f8655a4848e2aac1e5c69d6aef058481a2b49c7a46f4d325b05c2c0aea925680812eb8383cf8466c1b61673a711e877ce88e10b82ea0efdc9a2cf4ebe880b4277c9089bad507aa60e43e43059509b505cf1959e628756429f52a8a9b210fc3d5e9aa9ca6716e930e350946e79b22f47581c90429689288c2db90ae9ff14a7edbe290ff4d4ebc4b97e332fec4", ["", "", "", "", "", "", ""]}, 0xd8}, 0x1, 0x0, 0x0, 0x24040004}, 0x4014) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x1000, @loopback}, {0xa, 0x0, 0x0, @mcast2}, r2, 0x2}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000c40)={0xc, 0x8, 0xfa00, {&(0x7f0000000ac0)}}, 0x10) fcntl$addseals(r0, 0x409, 0x1) executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x1) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$poke(0x2, r4, &(0x7f00000011c0), 0xfffffffffffffffd) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffdfff, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x3, 0x7, 0x4, 0x200}, 0x9, 0x1, 0x6, 0x2, 0x3, 0x19, 0x9, 0x18, 0x1, 0xfff, {0x0, 0xffffff80, 0x2, 0x9, 0x2e571574, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000041}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x3}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x30, 0x2, [@TCA_U32_CLASSID={0x8}, @TCA_U32_SEL={0x24, 0x5, {0xc, 0x6, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0xebd, 0x1, 0x206, 0x7}]}}]}}]}, 0x5c}}, 0x24040084) executing program 5: r0 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x6, 0x100000c, 0x8010, 0xffffffffffffffff, 0x20000000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, 0x0) syz_ublk_setup_io_uring(0x5291, &(0x7f0000000040)={0x0, 0x16f1, 0x800, 0x1, 0x323}, &(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000280)) syz_io_uring_submit$UBLK(r0, r2, 0x0, &(0x7f0000000400)=@ublk_get_features_sqe={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0x80207513, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x8, &(0x7f00000003c0)}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x19, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @call={0x85, 0x0, 0x0, 0xf}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f00000013c0), 0x0, &(0x7f0000000100)=0x0, 0x0) r7 = syz_ublk_add_dev(r5, 0x0, r6, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f00000001c0)={[{}, {@i_version}, {@errors_remount}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}]}, 0x1, 0x4d5, &(0x7f0000000a00)="$eJzs3c1rHOcZAPBndy1ZktX6o6XYLtQGF9wPrNUHxVJbKD21PRhKXXppwVWltepqpRXalWsJH+T25kMPJSGBkEPu+QtyiU8xgZBzQq4hh+CQOAokgcCGnd2V9bErbxx5V9b8fjCemXfW+7yvlufdmXdmdgJIrfO1fzIRwxHxdkQcr69uf8H5+mzj4e2Z2pSJavXqx5nkdbX15kub/+9YRKxHxEBE/Ol3Ef/I7I5bXl2bny4WC8uN9XxlYSlfXl27dGNheq4wV1gcm7w8NTU5OjE+tW9tvfu/f9298tof+l/9/L8P7v//jddr1RpubNvajv1Ub3pfnNxSdiQifv00gvVArtGewV5XhCdS+/y+FxEXkvw/Hrnk0wTSoFqtVr+qHt1RuvmFvV4FDq1ssg+cyY5ERH05mx0Zqe/Dfz+GssVSufLz66WVxdn6vvKJ6Mtev1EsjDaOFU5EX6a2PpYsP1of37E+EZHsAz+XG0zWR2ZKxdnud3fAFsd25P9nuXr+AynhkB/SS/5Desl/SC/5D+kl/yG95D+kl/yH9JL/kF7yH9JL/kN67ZX//V2sB9BVf7xypTZVm/e/z95cXZkv3bw0WyjPjyyszIzMlJaXRuZKpbli4c87bxNsoVgqLY39IlZu5SuFciVfXl27tlBaWaxcS+7rv1bo60KbgM6cPHfv3UxErP9yMJliy1e+XIXDrVrNRK/vQQZ6I9frDgjoGUP/kF7f4Bi/g9E/4FnU4id6txloXfybWHoq4YAuyPa6AkDPXDzj/B+klfF/SC/j/5Be9vGBJxz/j8eN/+tf4OAy/g/pNdzm+V/f2fLsrtGI+G5EvJPrO9p81hdwGGQ/zDT2/y8e//Hwzq39mS+SUwT9EfHvl66+cGu6Uskk5Z9sllderJcvj/ei/kCnmnmazH2RA0CqbTy8PdOcuhn3o9/WL0LYHf9IY2xyIDmHMLSR2XatQmafrl1YvxMRp1vFzzSed14/8zG0kdsV/1Rjnqm/RVLfI8lz07sT/8yW+D/aEv/st/6rQDrcq/U/o63yL5vkdGzm3/b+Z3ifzm227/+ym/1frk3/d27bO623jfHPl//zQdv4dyLOtozfjDeQxNoZv1a3ix228cHf/vKDdtuqr9Tfp1X8ptpSvrKwlC+vrl1KfkdurrA4Nnl5ampydGJ8Kp+MUeebI9W7/er0W/f3av9Qm/j19r7Xsv21sp922P4vf/jmX8/vEf8nF1p//qeSeeu//2BE/KzD+J+Ov//3dttq8WfbtD+7R/xa2USH8cvP/969wwBwgJRX1+ani8XCsoWDvzB4MKphIQ0Lj+s52h9vAs+GR0nf65oAAAAAAAAAAAAAnerG5cS9biMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGHwdQAAAP//2SbWag==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) socket$unix(0x1, 0x1, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="120100"], 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) futex(&(0x7f00000002c0), 0x1, 0x1, 0x0, 0x0, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) executing program 4: futex(&(0x7f0000001cc0), 0x5, 0x0, 0x0, &(0x7f0000000100)=0xfffffffd, 0xaffffff8) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0xfffffffffffffef3, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x100, 0x46951}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x1}, @IFLA_GENEVE_TTL_INHERIT={0x5}]}}}, @IFLA_LINK_NETNSID={0x0, 0x25, 0x4}]}, 0x58}}, 0x2000000) executing program 4: syz_mount_image$ext4(&(0x7f0000000080)='ext2\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f0000000b80)={[{@test_dummy_encryption}], [{@subj_role={'subj_role', 0x3d, 'dont_appraise'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@smackfshat}, {@dont_appraise}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x8, &(0x7f0000004380)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000050000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7235f1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a49bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5}, 0x94) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="680000001800050602000000000000000a400000fe040001000000001400010020010db800a000000000000000000001080006000001000008000400010000000600150003000000200016800c0001001234567890abcdef0500080001000000f5eb05ff52cebdd3", 0x68) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) unshare(0x60600) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000240), 0x802, 0x0) ioctl$UI_DEV_CREATE(r5, 0x5501) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x40) (async) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e0001000000000000000000040100800c0002000000000000000000140001000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c94ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767fc734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, 0x0) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000380)={0x8, @win={{0x0, 0x8, 0x9, 0x8}, 0x3, 0x9c33, &(0x7f0000000340)={{0x7, 0xffffffcc, 0x6bb5, 0x9}, &(0x7f0000000300)={{0x6, 0x7fff, 0x0, 0x7ffffffd}, &(0x7f0000000180)={{0x480000, 0x100, 0x5, 0x2}}}}, 0x101, &(0x7f0000000480)="88ef61ba5df9537a4e2d8e50f5201a54340351b58aa5cab0eddf24f2d44e0c0600000000000000eb3c5b99ef0203efabc91b9d32537a49dd460f969433890e93f2b06478dc04407ee6321533406497959063ec3b8db13f728c0a24ffa3b44b171ab19f8604bc0bf3baea5ba04b443ed837a9191b32a3e91333beeb69b0a63cbf76aad4630ee8643eb061b62a64f5a8c3d1555462182a26b41a3d74b32f6499dfe01926f6d3e2b5593f2aa13aabb33ce5af5924182b186f01e07fc05c39fac762db8e1ebbe4850fabd5ec8acc", 0xf7}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000580), &(0x7f00000005c0)=0x4) (async) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0xfffffffffffffe17) (async) sendmmsg$unix(r9, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r8, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e20, 0x8, @loopback, 0x4}, 0x1c) executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) (async) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) (async) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) (async) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) setns(r2, 0x24020000) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) setgroups(0x0, 0x0) setuid(0xee00) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setresgid(0xee00, 0xee01, 0x0) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) setns(r2, 0x24020000) (async) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setgroups(0x0, 0x0) (async) setuid(0xee00) (async) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) (async) executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) chdir(&(0x7f0000000080)='./file0\x00') socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) (async) chdir(&(0x7f0000000080)='./file0\x00') (async) executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000001c0)={0x1}, 0x8) sendmmsg$sock(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="dce4c739", 0x4}], 0x1}}], 0x1, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000100000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x9}, 0x94) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000200)={0x2, 0x1234, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x48, 0x1, 0x0, @rand_addr=0x64010102, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x1234, 0x1}}}}}, 0x0) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x2, 0x6, 0x8, 0x7f}, 'syz1\x00', 0x56}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r1, r4, 0x3, 0x0, @val=@iter={0x0}}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) sendto$inet6(r5, 0x0, 0x0, 0x240088d1, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1f}, 0x1c) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x7f, 0x3f381aebd606354e, 0x4, "", [{{0x9, 0x4, 0x0, 0xf1, 0x22, 0x2, 0x6, 0x0, 0xd, {{0x5}, {0x5, 0x24, 0x0, 0x9276}, {0xd, 0x24, 0xf, 0x1, 0x7ff, 0x1, 0xf, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x5f, 0xc, 0x7f}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5, 0x9, 0x8}}}}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) executing program 5: setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x438, 0x240, 0x240, 0x0, 0x350, 0x370, 0x350, 0x4, 0x0, {[{{@arp={@private, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_to_batadv\x00', 'batadv0\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "bc2e329885ea3654891fbae8c6c66e07212432bde429bcda7deb48d85c6f5e269c2021c8f8dc09af0b3f2e10e8ac79cc67e264613c4be6838ee2daacf7926a6e"}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr, @broadcast}}}, {{@arp={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x488) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c) (async) syz_emit_ethernet(0x3a, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x10, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x8, 0x2000000000004}}}}}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)={@fallback, r1, 0x36, 0x202c}, 0x20) recvmmsg(r0, &(0x7f0000000040), 0x400000000000338, 0x2, 0x0) executing program 3: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f000004f000/0x800000)=nil, 0x800000, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000003180)=""/4112, &(0x7f0000000000)=0x1010) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f00005e3000/0x3000)=nil, 0x3000}, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x1c, r0, 0x303, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20044080}, 0x20040890) r2 = getpid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x200801, &(0x7f0000000380)=ANY=[], 0x1, 0x1c8, &(0x7f0000000ac0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbQTQ7A8NCKL/ilva6Naf8zpz01NVaJsvM0OqpLY8sJpfaY+QmuZhHgpkhNPXIouLKquzEnJzUouKFDBW3kpMqTp9gYLluf02lWSKcF2Kigw7TER+PrBmNJZyTpDTF2NgyFc6e+SC/jk3jCMOjFcwb6zzzGusKU6fmpeUlVWVVZc2bOHHjzMbOxsaVE+ui0vxWMbakuGxq6mRkctiiJrCZ2VB9ko32hHftqx4mObD2ePg1nzJWep3KwmDMyiZ1akXVzAlflGYzGn5nuMPzHwokLBpMOPkhjrmVnNLAkHYxjJGDgYGhbcuZOSHM/GxuCxRakk8whR7lWDpTwuKAUNXJn5aabx0S3WZse+rAdobn8HGeNQV9gkbHJRicFgr+lwH5NKGhoUxjLdNS2wVfijT+SnitNnbKYHC3Z1raDA1IlgYQuRLKkwXrSUhe4aGjqWmUkpzQsEnCM4SBwVCZYeseztUCDQxI0abCwMCwnREWtxBwjY1hFIyCUTAKRsEoGAWjYBSMglEwCkbBCAKAAAAA//+BbpcE") setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x6000000}, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) shutdown(r5, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x28, 0x10, 0x400, 0x0, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x92e2b7a147cfdc67, 0x21020}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0x6}]}, 0x28}}, 0x8000) executing program 3: syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="dcfffffffdc477f6bbbbbbbb08004500007800a40897e7010102ac1414aa03049078010000004700000000000000001100000000000000000000440c0001ac1414bb4e210000443c0001ac1414aa000000000000000000000000ac1414000000000000000000000000010000000000000000ac1e000100000000acd6709c1e5b25233a8b81104ccddd4551a2d96d5a42c85ff51bd977d30366b6358925e2145d74cbef7ffecf07a4762b8c54a107e8e9a749e0d5b539cc98a966392af1d1e3acec4ecf390f1f47f91f4b73dd65985b487379b3dd6796c08d183eb10c453b8872503ac5bbe60ab79f427cedcf398aed80048c627edeb98f46b1fdd6a8f542ccb48524da4a094aa274f930fd986e26a9c1ac2f0e86ac06cc2578de49a7e6a7316192376106d85d798dd1a77b3fc9de2aabf1f796b535a708420f0ce13c1b4747000000000000000000000001c5407e4e401210c63e292e418972dede0a25978c07cb36932a28e225aad29940a76dd5a7246f753e840d98e24623316da93cac00f1d0bf4a0fe0404fd7d679115b7160f45a6acbf99cb649ab0fb6105ccfb3376f1ff82b80fb5503f2a332f08619b285570359a39fcdab8376397f52de0d78dec6022b8704080132f74f10b294355fae7b0a24a8f8cf0aaa4a3344ab63324e0d41ec60730f0d236f76c0e7dd5c8474d2b17831a980302f8abb7830e85bc2d5ece69b37e9b9"], 0x0) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x109882, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x169883, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x64) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: bisecting 37 programs bisect: split chunks (needed=false): <36> bisect: split chunk #0 of len 36 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 11, 13, 17, 30, 24, 24, 9, 11, 17, 3, 30, 26, 40, 5, 24, 24, 22, 18, 8, 11, 29, 1, 7, 30] detailed listing: executing program 2: ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000000)={0x1, 0x80000, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x50}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x64}, 0x1, 0x0, 0x0, 0x41}, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_NOACK_MAP(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x200, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3, 0x6b}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x4}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x8}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x7}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x81}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x40}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x81}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x28040810}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f0000000380)=0xb, 0x4) sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x8c, r1, 0x4, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x48, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "f7097f151e"}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DEFAULT_TYPES={0x18, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fdd19409c0"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a237643dc2"}]}, 0x8c}}, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000540)=r0) syz_ublk_setup_io_uring(0x2abe, &(0x7f0000000580)={0x0, 0x3f33, 0x400, 0x3, 0x3e8, 0x0, r0}, &(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680)) fremovexattr(r5, &(0x7f00000006c0)=@known='trusted.syz\x00') sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x885}, 0x20008014) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000840), r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x7c, r6, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x8}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x7c}, 0x1, 0x0, 0x0, 0xc004}, 0x40004) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x80c4}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x14, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x800) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000a80), 0x241000, 0x0) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000ac0)={0x41, 0x0, 0x1}, 0x10) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000b00)=""/235) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000c00)={"09f636fe", 0xbe, 0xc, 0x20, 0xffff0000, 0x7fff, "3e09d3af5a0503cdcb8f2669a865be", "a70df515", "f1b0571e", "3858c548", ["0d027c516659898f69ea0d81", "d0e6b18081296a9746b90c16", "39218bba00c95606c4a65116", "27cbc8a397f4e0370af7aa75"]}) keyctl$get_security(0x11, 0x0, &(0x7f0000000c80)=""/153, 0x99) sendmsg$SEG6_CMD_SETHMAC(r7, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x1c, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c0c0}, 0x4000000) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r0, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x14, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}}, 0x20000000) r9 = request_key(&(0x7f0000000f40)='big_key\x00', &(0x7f0000000f80)={'syz', 0x1}, &(0x7f0000000fc0)='\x00', 0xfffffffffffffffe) r10 = add_key$keyring(&(0x7f0000001040), &(0x7f0000001080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate(0xc, r9, &(0x7f0000001000)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'trusted:', '}.,{*$'}, 0x1f, r10) sendmsg(r4, &(0x7f0000002480)={&(0x7f00000010c0)=@isdn={0x22, 0xd, 0xa, 0x3, 0xb}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001140)="8766001e519cb7ee4f794fac17a761d338ea7536afc7980343f271ce75afe58f2487c3eb5552dc7936091802588c5ea19c1380488a54efb23efa029473d461c65cb6b8f9a44eb3ab0aa3a773cf59f4835c6c31aff950a7256b98e68d78baeb1b2c9725ecdc5d4ac0b64d6045b92bd89cd2a2f0e88b126ec2dddf2375a84d83a60f4e1efc581978cb04bcf48984f8e23041f49b1fba64340ec72eedb760c83d096a3622b3de09870de915bb7e4b31ed8997f4d71a33cf8339295450b27ece71be9fd9476f3021a1f636491e1bc69878677f4934da9ac89125cae26355e61a6241d31d1a2afa1fbdf98a2ac86a0b0b82c5062d23b426a42bd05bebd90462", 0xfd}, {&(0x7f0000001240)="0056b9b5bbd098b5b54ac72ed5cd124e7392d3b09c65b8e4cce95bba374dbbbd33212f7911499e19034838b6aeabe781e071de928d072d17025efee6b6c9e36b954f55e56ec56a9fa9d965abe25589ba09db18269edf3fe8435e29f8a1aee5afd89c384c148873e4461d73233d62dd20672ed4e8d19afca859598ab5845898c65908b7eec485e7531c519b67e253c12904596b68f77d36bbed9f8a4407303ccbeadac07cc31c610cfd7aa479e03c87322887db72891d6f4f2ed23cccecbc8563df94e12b67af", 0xc6}, {&(0x7f0000001340)}, {&(0x7f0000001380)="5ecbc441437f08a460d8bc66e1c99718a96a8257e0417414ed32a12c6ec7b50cd0", 0x21}, {&(0x7f00000013c0)="1dbc964f6a3bb359a47895cc6ec6646dc97205ed349202f0faa4c142b6b30a5b666191c59c76a7ef2379f23fe1df1403bd052eba7f522298cbcf681c93e9b6eecadc8c5f453aed1661ec2ad9a02cf9088e28794e843dd75df03c6aa4e4d677239916cafeb15ad71d72f77728c68552112109fa69c356ce8e61930a40a002811e9a4dd3e813ad8cb7d7b7ece9d323f102a72a192a3aae1332b2715ce242e3f934dada504242b338254d1ee50f3c431a1ddfbd520fb6ab29415e9513599dfbb498371c8ab9cc6a42cca4e3071c34cb57b3ca4d73b7d0d4de259d8f17f6f7c5585805cf7d6c3ed672473ba00bca6ee271d38f627b61bdd8a3c123d6531c118c9ac44b7b602e782141685a5c7f16d40e43599540707559f2489d6e5ff6e0fd5c4ffb61a08d39bdb8cc2b454a573f102871a934aed1c2e63d6cde394194b9d85946934cf2dfc9831077ec7a2e244e37f62b890be506867f033377412a5636e523f1ff35b1dd9ff3af0e3249ca41cc51a79c787a53cc85cf49108d673a254cf6d9d4c5a4f5b996ce7b3b9a77bc4d428d5bc0b440cac7e531b1c68f000f6e9a95baa5d17385bda73168c51690b15812ac254f8e8430bfbe07ad52e1ffb3cac864c6fe23f9f8e4f1eff5936da0878db40883aa8c3570689e42404f88ea1807447e11ebbee19e364452cc7d377f28459c4e8f8cb260bdbe41f226298e98d608ee1d300b762cfbca73dff4939161ad1a5a4c4e58859f0bf8234ad92e3ee3ffd65f525c406be070b3f993c9427770ab2be39d83c02f9042ccf4e827134ac1676cb60ad569b4283d53319aa3a44ea7d05a3e235ab027d4c006cdfc243ce6b4303bf48825554946a23571c2325cd7f0d6f6c5fc4a90bb723b9e1232f59f09d60a0cf87f5c0303d90c1868fb773933065a7a072c0adc91cad2af38e8f013076ae0d8e02c44498b91cc290c1f1ec8277c2be80fc78ec233faedd441e508c6b653fb553de82349e8a54e2f7119dfcac5d976dc914db6d71f2df361a747bd84f500abc82db789a244da09597b4bcff82640d601da68701392e9fbc871f365fe30a8db0b878048c4668cb1ff01f42a4b77ac7ee54432384eeb337f0a801f0836f2267406b85500e790a129c5c48d8da6d222ea1c0a2baa0f0bb9542783ce71efe00687a123a9f6dbc5ff0daf0bca5a6e4febcc31da987ba8f917a49e100a3d65c724faec6ccbbe1efca334ef7fee3d8d974334461002cb7eea8ab6188f630ad0cb37e6b7f4224b46f15bff745ccaff20e4532e491d20f10537b1aaceffa6685572749b145261729d2984aa9c324960dd8e358e2e0fd757ce55709753a80f53960951d361ce32b98ef8e4d78cc7f1f33b0f8094c7a7e5859bc43b72d3feba296d3200fec2d26a227c7b15e78a2f238358fcb14ded5689773ee20ea1ef8a2d125ff935ae7196950d418718a7a3fad9b87c8fe100eeb7adcfd748974c7007ae470c4a2a7646490a305c47e31871fa76b275d67ab4290e3c008d1d0009c70705dd1590ea2a2f9b1c1769f1a9ef997a4f4ba96e084b24f0b235a83c82bd4fa131f4e80725f3bb4f0aa4f1d5f4e1187d059dcfc6743f5438ba2343bd079b5839591d7c70971993996c43375f5a3db0ac58a682407763ca5477e27bd63328f35c84de49e24cbfe454f289a62e7404dc68a34ab7fd43ceda38ac129a72e98a779857854792be7183b7352ca114f7a60915db6c2b86df48985d18c275003383e9bebc90fc121a8c8c4703e88875d054dacf76f45d738c7b06eedd47b3474ec4207220378ac2dc8a2e199ad302cfaf38ae0fa9f639db241ebd392458403b74ece988029f6ecf8a373dd7dbf7b87c96c6bd8ae7790de5c106079400e150893b44c0b9b8fba8768242e2e098df446726598513d7fd035667ec04970b2faa52ec72608ce04d7b514a13d3a538769c35ed82be43cc7d6c95860b37ed87588f2555ff6237863c8ff53a7bf8aa39a1b3e5e6cd60e6c6fff09f5bb324bf437c4ef0b482c07e1e478688c81886734a53a87ae4e233beb7f22d34ae7d9a7dcf9b83bdd31315e6a60811dbf72f3aa5f6cb0e3da7d90a66d5e41d8ac605828682b3172bcb10356d20ab38626d963cbba95eb3d1ffa8dfb3bddd75504064aaac39091f3a209e548037cb67d10fa1cd67617b7038f1eaf769d3fec5c0510b9a06716928736702e0bd623fff8bae86ecf0f3b250251300b4da7c3dafee6352de225d77bbf4ee6ac478b354ab0ee484d972b67c5d6570c574e33c10f759c36f996b58d7c1530915e4b32536f63904d9829aa44db6c2fa8f6c3a455cdd5d5239ca81740fbf33815e896d8bd9c7960bcc55421de3a0733dc6fad9eafb1309aa648a34aac6beb4efadd565c3dc8fdbc98a4e40d6ac6df8e04dfc0fc9c7b68fd4ed0939a9f3902b38338465b3a0fa532769cca421c171789eeb911b8375ce861b4c68f5c93a8816d9ff1263845154b4a35a9eeecaba1371687bbc8e13a2ecafc537ebb49e2435e6f9f304639207bfc11025b89d36df38943ffc06f7caeec8aaa0e9d97a79fced5ac369824fef1a918431d5c2cf32127d201a7018bc2a8dc5dfd347e305b268b284a8fdbf716b794fc97bf09ae20be5ec8b48c9393b6d11c73889ea72b6b96ac3ab2a9038951bc6d3d4e4f288343e5ba6708cb7248da95f121b57c213a6f2e5892bafe4186fd9b32b67949011a6782c8c56fa3fe871e698be899d136155246e6ddbb7fe7fb2d49272954c8c442213ef2ee50d74c1ac62c733f7c7ce225a7080ff5a6b41dadc5d451801a2a79241b046287eadf67651e21f35805e5f5754fdb1e7c67801231758136b090213f6a2967c206fe339e5d96274f1af68c81ae16b19aac7f329f9dad59a2bb4c84cab3508469f19c92db2bc56bf3b6e3eaaa28838ba9c0ba755e2ac00dccac0d9db8ed04587399433cdd057330ca45789b35c4583493d48304fde386862f032760f038d646639b22c88b17d4fe0c9902e269cd3ec2a200c2a9d497106d4e3d6d95652d43129a2b59522f90b94e18625df7ef8f99d67cf0e736d7587cca8eac1a144b30658420a9c2b64be94ac89a28fba72b36e1d34207bc0bfb89cc592a7a30d768617d181d4dda02ce2bcc3cbec3604e6f79df9d54237fbf128e6e3590038d04968c7a72743f9ead77b1f393aa26b3b6d2906516f7aaadc3764022aaab5414db4a275389d24258d72da0d136b1d156d8c48a16855310f1db89ea9b6f24fba3ab709f18dd8118b15f038c3a18c29ffa2d18554299871d74c4e92655c511262d80b4fc34aa9333bf738706621cf63e50d42d0570ace9e1294463154a988c148b227a2260097bba6c4edddf1db5412b66a61c4a1b2994d33a531ec43840fa2dab5e6c3d3b324bf5f093095145fcf7e83c0b3d1cbd01f83651f1771e8262565b8fba24e2b0c1a87e97f8b29a0159288be08854a656f0bc6b299ebd52a0dfc531e7f5555be5409c06944f9fa25ad8dcb308d802d3f82952cfe6ed9c2fd82979fd0288d1a36f8a046ceef207fd145f57558fae4ef5bac3052f3de024655d365a236fb4c13a133dec574e9c4a84b9be9335355ae09c6e3a579dc230c24aea085016aa1b2af5c90973a3f84de650170e9ea16895c1179728d327cccefcd9609ba8dcca73413359b51161fcec39f748491d271c22f604d753170ab3c1a50c97a8cd866f904e466d42a3d814c791f94c89a382911cc090d3faa5eafcfbdc8b38c0609db021597cce751b2166057ed4202c07de185576ffb8d503066b4ecdd95f12a90585e4e8317530ab3b733ef6fa5f5cb7def6b57e8d2754963b8385dc4910305c4fece0b13aecca8bdf23b4b69240ad78d81441c2841e97416ea078e6b00f99064a587e0545e69244bc22167e456df09bc7f4f2187b79dc7afba3b65a74b7a2fb7169daeea489db6cd7e579c97f3df75f45ca9aebb30d654598633a2606ede428c40c9dbc6db48b782190905c8e87a8cbb0550984fa932d2cf3531acc4495a7121bb5ff223b9a0b5871d54480f06d0ab25c93ad03b65a515fbf25732c5c91e3ad21f2564a498ea9956fd1e1628633498a146f241a54dbc053a5b3aea23d686175572e11abd97e55135739f07816940b605abac886ac0645929fe64f2bd4994152356ecd41bb9a5c18b279f2553ff6455109d9a2fa68ee5f11d47fd6444192eb6142f170e7de86930ef27a5164f9fe615bc2e6092acc54719db6323278eee33adb2436807f0dc66a8d3201a9ca3cad07714245859ab257dec8a6ada92500b7b45c1b7219d4c93d224b02e456505bddd02edbf9ce7145a54646967692cc6a5f0329374b1ff6d103a96be9e802dc70dfca9731ac0f71a487175b6f1f2cb034b7f1a5de4936ace474978a1bf55b07d093fcfc91c9f4f4dd0e9f3a8651f9a9de26c73e221164e726f436b8ae5b6ff7e60b2518e27cd2f2b883d6376790a43c5c8e9350242f8a19e35e4f644be39a0eb94c0712edecff2932f2418ce02636d9e8a24ce82ade0c0bd05127b78f7c2036642db6687e5864d2191ea156cc742efeecd8b3dbb09a17f967bb9237369c11df80db466e025fb201bbd93c8dfbee56ecadca5eff0be43f85e9417fa303bbb116a91aeb18e379ad7037e2c960e880cf83194f560d07373dc70ff3031a4bd5a4a3846d6f8342d0e0a70c1dd36dde98c09f608c2a201bccbaf95e0021257a4b2d351d17c7db3d891da4156845180c52deb2ec19e604efafa1555836dbc37d759d722e2553b99ac051b226b0ff932dd24fdfbf739f6e666cb8998eb86b771ff01b68e7c5760d08cd0d17e48c39df1bd87176e5ca33e915703930a7340c07d7f7fd32b3f55a43b52db484bd008b42c756afde94605e22c8dd1f3ab34e5ab35234a72746e364a97bc7e1b25631a0d6dcf2a87cd847cae85ad4a2be50c2b41128bde6b5323652d83ad4b47cd5280f37eae54e5f37f2509d9c140b9b8010ec93b7fc667d80a92ab9b9d46aeb8c3ed41f8942e785afea6d1087b0cb690a83fb7bdaead5ff796e905fe6aa2196a56f14d78a1229e6366fdeb284c3b8cf2d9f2cc5e83ffdca8dd1e7ed1614e7875ddf9de757bcb40c1857e2fc01be081b7a7fe58719b61d0b6ff39b285a753a63bd370f726126aaae39d2816f3bb4a51aef590bf2778432abad9fa27b5824edfe3ec4ff01edb2cc85c7eafebd5828b3de2b9de813c72eb4f256a051659524e1ddc7be8f6b2704a821eaa59b289cfbdaa909549aa738126e8072816ceffcbdd1ec395278d1055bee854e0e2196bad0af08a69cea4f324cfa8e87fd60bd653dc75b32370a1bb1dcea4343c5968707c4fea7cb148c5b1b84e3f79b4f053e8a8b4d3e8dc1addcb9eed64f1fcd814587c5e04b3ca3e6539bb9894ba35652eb78ec82e487bbdac7f009e9c2d83d3a50ea0ea3894247a64b73abe1aab18cdde10246d574986a2d18b44f1cab84ecd0f3d1559ad0c8dd7291a308c36d26f370d665bf3e300e33d0de17e939364ab600925f883c4a56b0414b5815ca2f0ba965c4402c5ba138c2c6da8b4823a327d7cfbe38132e3bfe6fea694d0ae7e9ad9fc62c4665dcc93660b5e47695d1a10c3cb54115367a4a1493720cd0b486c6573e6f35e8eeae0169f8e7c88977f22df411efc35ca5575094a4c988d120c4c65ac41b2a53b7f89394e07c0627b3c3d058bbe6862d9e7e6e9f4e4ed203af0f9e389e194ba4cc59bba8566753b1cb638867e961ce0ba9c6008ce885000161061d3284670d1d7978368cdd8ac356342651937e4ebdb01b9ae3a73bcd0375e", 0x1000}], 0x5, &(0x7f0000002440)=[{0x28, 0x103, 0xd, "0b1fb299d122a6a050dd2559584fdd5152abc9"}], 0x28}, 0x60400a0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f00000024c0), &(0x7f0000002500)=0xc) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="4401000010000100fefff7ff00010023e0000001000000000000000000000000e0000002000000000000000000000000000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000ffffac1e0001000000000000000092010000000000003affffffffffffff00000000000000001c250800000000000200000000000000f8ffffffffffffff7c232e0e00000000090000000000000000000000000000001f00000002000000feffffffffffffff02000000fcffffffff0f00002abd700004350000020001000000000000000000480003"], 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0xff, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@report={0x6c, 0x20, 0x400, 0x70bd28, 0x25dfdbfd, {0x2b, {@in6=@empty, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e23, 0x0, 0x4e21, 0x2, 0xa, 0x0, 0x120, 0x2f, r3, r4}}, [@iptfs_init_delay={0x8, 0x27, 0x3b83}, @extra_flags={0x8, 0x18, 0xf4}, @tfcpad={0x8, 0x16, 0x6}, @proto={0x5, 0x19, 0xff}]}, 0x6c}}, 0x10) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x12, &(0x7f0000000bc0)=ANY=[@ANYBLOB="bf12000000000000b7030000000000007b3ac0ff000000007b3ac8ff000000007b3ad0ff000000007b3ad8ff000000007b3ae0ff000000007b3ae8ff000000007b3af0ff000000007b3af8ff00000000bf21000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f0000000800)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r5, 0x0, 0xe, 0x0, &(0x7f0000000a00)="0123456789abcdef0123456789ab", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000180)={0xd, @pix={0x200, 0x2, 0x32314241, 0x0, 0x0, 0x0, 0x3, 0xfeedcafe, 0x3, 0x0, 0x2, 0x1}}) executing program 2: prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) userfaultfd(0x80000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0, 0x180) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) r1 = openat(r0, &(0x7f0000000140)='./tracing\x00', 0x600381, 0x20) write$tcp_mem(r1, &(0x7f00000000c0)={0xffffffffffffffff, 0x20, 0x58}, 0x48) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c033, 0xffffffffffffffff, 0x0) write$ppp(r2, &(0x7f00000004c0)="852c9075", 0x4) move_pages(0x0, 0x1, &(0x7f0000000000)=[&(0x7f0000ffc000/0x1000)=nil], &(0x7f0000001180), 0xfffffffffffffffe, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x400000, &(0x7f00000000c0)={[{@noload}, {@abort}, {@data_err_ignore}, {@nogrpid}, {@oldalloc}, {@errors_remount}]}, 0x0, 0x467, &(0x7f0000000500)="$eJzs3M9vFFUcAPDvTLflt62KP0DQKhqJPwotPw9eMJp40MREDxhPtS0EWajSmgghWj3g0ZB4Nx5N/As86cWoJxOvejckxHABNSZjZna2XZbd0rVbFtjPJ1n2vZ23zPvuzJt5895MA+hbo/k/ScTmiPgtIoZr2esLjNberl05P/XXlfNTSWTZG38mRbmrV85P1YvWv7eplsmyMr+uxXovvB0xWa3OnCnze+ZPvbdn7uy550+cmjw+c3zm9MThw/v37Rw6OHGgK3HmcV3d/tHsjm2vvHXxtamjF9/56Zu8vpvL5Y1xdMmG0dqv29JTXV5Zr21pSCeVHlaEjgxERL65Bov2PxwDsWFx2XC8/GlPKwesqSzLslbn59JCBtzFkuh1DYDeqJ/o8+vf+usWdT1uC5ePRLx/qBb/tfJVW1KJtCwz2HR9202jEXF04e8v81eszTgEAMB1vjsSEc+16v+l8WBDuXvKOZSRiLg3Iu6LiPsjYmtEPBBRlH0oIh7ucP3NMyQ39n/SS/8rsBXK+38vlHNbi/2/f7Mi/tLIQJnbUsQ/mBw7UZ3ZW/4mu2NwXZ4fX2Yd37/06+ftluXxJwtLfcB8/fW+YE16qdI0QDc9OT+5yrAXXf4kYnulKf5CEvVpnCQitkXE9o7+56UrjBPPfL2jXanG/m/r+JfRhXmm7KuIp2vbfyGa4q9L2s5Pjh86OHFgz/qozuz9J8uyYq9YslC+//zLhdfbrX9V8XdBvv03Nu//hcX4R5L1EXNnz50s5mvnonmG+KYu/P5Z22uam8ffev8fSt4s0kPlZx9Ozs+fGY8YSl698fOJpe+W+Upj/Lt3tYo/LY5x9WgfiYh8J94ZEY9GxGNl3R+PiCciYtcy8f/44pPvdh7/MqPyNZ0ealvK45++2faPxu3feWLg5A/fdh5/Xb799xep3eUnKzn+rbSCq/ntAAAA4E6RFvfAJ+nYYjpNx8Zq9/BvjY1pdXZu/tljsx+cnq7dKz8Sg2l9/HO4YTx0vBwbrucnloZgivy+ctz4i4ENRX5sarY63ePYod9tatP+c38M9Lp2wJrzvBb0L+0f+pf2D/1L+4f+pf1D/2rV/j/uQT2AW8/5H/qX9g/9q6n9d/Z0J3BHc/6HvtT22fh0VY/8S9z1iUg7/1YlelrnpIM/DHH7JCprXed1LRf1+sgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHf8FAAD//4sz60A=") (async) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x400000, &(0x7f00000000c0)={[{@noload}, {@abort}, {@data_err_ignore}, {@nogrpid}, {@oldalloc}, {@errors_remount}]}, 0x0, 0x467, &(0x7f0000000500)="$eJzs3M9vFFUcAPDvTLflt62KP0DQKhqJPwotPw9eMJp40MREDxhPtS0EWajSmgghWj3g0ZB4Nx5N/As86cWoJxOvejckxHABNSZjZna2XZbd0rVbFtjPJ1n2vZ23zPvuzJt5895MA+hbo/k/ScTmiPgtIoZr2esLjNberl05P/XXlfNTSWTZG38mRbmrV85P1YvWv7eplsmyMr+uxXovvB0xWa3OnCnze+ZPvbdn7uy550+cmjw+c3zm9MThw/v37Rw6OHGgK3HmcV3d/tHsjm2vvHXxtamjF9/56Zu8vpvL5Y1xdMmG0dqv29JTXV5Zr21pSCeVHlaEjgxERL65Bov2PxwDsWFx2XC8/GlPKwesqSzLslbn59JCBtzFkuh1DYDeqJ/o8+vf+usWdT1uC5ePRLx/qBb/tfJVW1KJtCwz2HR9202jEXF04e8v81eszTgEAMB1vjsSEc+16v+l8WBDuXvKOZSRiLg3Iu6LiPsjYmtEPBBRlH0oIh7ucP3NMyQ39n/SS/8rsBXK+38vlHNbi/2/f7Mi/tLIQJnbUsQ/mBw7UZ3ZW/4mu2NwXZ4fX2Yd37/06+ftluXxJwtLfcB8/fW+YE16qdI0QDc9OT+5yrAXXf4kYnulKf5CEvVpnCQitkXE9o7+56UrjBPPfL2jXanG/m/r+JfRhXmm7KuIp2vbfyGa4q9L2s5Pjh86OHFgz/qozuz9J8uyYq9YslC+//zLhdfbrX9V8XdBvv03Nu//hcX4R5L1EXNnz50s5mvnonmG+KYu/P5Z22uam8ffev8fSt4s0kPlZx9Ozs+fGY8YSl698fOJpe+W+Upj/Lt3tYo/LY5x9WgfiYh8J94ZEY9GxGNl3R+PiCciYtcy8f/44pPvdh7/MqPyNZ0ealvK45++2faPxu3feWLg5A/fdh5/Xb799xep3eUnKzn+rbSCq/ntAAAA4E6RFvfAJ+nYYjpNx8Zq9/BvjY1pdXZu/tljsx+cnq7dKz8Sg2l9/HO4YTx0vBwbrucnloZgivy+ctz4i4ENRX5sarY63ePYod9tatP+c38M9Lp2wJrzvBb0L+0f+pf2D/1L+4f+pf1D/2rV/j/uQT2AW8/5H/qX9g/9q6n9d/Z0J3BHc/6HvtT22fh0VY/8S9z1iUg7/1YlelrnpIM/DHH7JCprXed1LRf1+sgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHf8FAAD//4sz60A=") mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) (async) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x2) r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) pselect6(0x40, &(0x7f0000003d00)={0x9, 0xe1c8, 0xffffffffffffff7f, 0x1000, 0x0, 0xf5, 0x40, 0xb08}, 0x0, 0x0, 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000003d00)={0x9, 0xe1c8, 0xffffffffffffff7f, 0x1000, 0x0, 0xf5, 0x40, 0xb08}, 0x0, 0x0, 0x0, 0x0) syz_read_part_table(0x61f, &(0x7f0000000cc0)="$eJzs0z2IHVUbB/D/mfu58L5skNhoMAvamsI0sViSRaME0V38KmzERhCsAhYWcm9ICittbI0IKcTCNGoV0UJ2BfFjtQkWIiHYWCmiCIGR+bjZC4rNLory+3GZOXOe554zw/Oc8C83Sl2XlaSUZJ5k9Y53kmFd17NkPuyTxvn22mTa5/fWkifefvT+xx7a2mhy+8kj/2vzy1JuyYmn28Fgb9d69Z7dNz+976f5/LM7v9oZdGlJrlTJ0eRkcnOqe61pBq9f+q7sTUJyeX179XxVTzJaf27cN9y9Zd7G6saslHZyuvSn4x/2TbV/g0VDlpKrD750/a7dE812VdP8O7u/7fVqM/o+izdZSXLrI+30IqU7QvP21Az+sM+4uTSn8VQzeK85rJMD+QD2pe2/C2fHHw3bylx94/C1Uqo2VKVqivprXZ/r63+jniZH15pQU2EFBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADtLl9e3V8dLz8WfvPn37q9WpVCX5spvKShc7l2SQ5PPSJ7/28IHsf/7C2ZVM+kVHScabP178/7EvdkbZvJhMk0NJE67aX2v6ZHsb7/sF+Ed19R/llRfXfxl1U9Mf+tgt33w8WxT45/F0dviFthHnbUt03l1aqpzcGy4Gkz/bU9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH/b6QfOrG1tVI8nVRlOk1SHLm23kXl7revktg+eeuv5Tza+HiTZnLyf5EbOlDxTL62zNenuV6pMciQ5Nmyexrn+8iJjcDO3NMvWs7/rE/kLvwcAAP//Qq9sdQ==") executing program 2: r0 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fd7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) (async) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fd7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$ENABLE_STATS(0x20, 0xffffffffffffffff, 0x0) getpid() (async) r2 = getpid() syz_pidfd_open(r2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYRESOCT=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x5}, 0x5, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYRESOCT=r2], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x5}, 0x5, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r3, 0x702, 0xe, 0x0, &(0x7f0000000380)="e46057a4bf7c12f39d10ba334470", 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) (async) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) setsockopt$inet_group_source_req(r4, 0x0, 0x2e, &(0x7f00000006c0)={0x7, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @multicast1}}}, 0x108) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local}, 0x1) getsockopt$inet_buf(r4, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x91) (async) getsockopt$inet_buf(r4, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x91) r5 = socket$inet6(0xa, 0x3, 0x88) r6 = socket(0x40000000015, 0x5, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0xa) (async) connect$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0xa) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000980)={{{@in=@loopback, @in=@local, 0xee24, 0x0, 0x0, 0x3, 0x2}, {0x81000, 0x200000004, 0x40000000007, 0xffffffff, 0x100000000, 0x0, 0x200000003, 0x9}, {0x5}, 0x5, 0x6e6bb1, 0x1, 0x0, 0x0, 0x3}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x3501, 0x4, 0x8, 0x0, 0x9075, 0xef, 0x9}}, 0xe8) pread64(r5, &(0x7f0000000040)=""/164, 0xa4, 0x3) r7 = memfd_create(&(0x7f0000000600)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x80#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92\xc0~P\x1c\xf7\x9c\x8e\x87P\x8c\xfd\x81\xc6/\xbaV\x1f\xb1tH\xe2\xa3\xa1\xb6\x17\x19m\x16\xef)\x18\xb0\xe39\x91\xa7\x9e\r4', 0x3) fcntl$addseals(r7, 0x409, 0x8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000000, 0x13, r7, 0xeff74000) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x8}}, 0x7}, 0x1c) executing program 2: capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x0, 0xe, 0x80000000}) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) capset(&(0x7f0000000100)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000140)={0x40, 0xfff, 0x1, 0x1, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0100000001050a0000000000000000010000049800018006000340000200002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000022c00018014000300fc020000000000000000000000000000140004000000000000000000000000000000000106000340000200002c00018014000300fc00000000000000000000000000000114000400000000000000ffffac1414aa2c000d8014000500fe8000000000000000000000000000aa14000400fe8800000000000000000000000000013c00188008000240fffffffc080003400000080008000240000000030800034000000101080003400000000808000340000010000800014000006edb0600124000010000"], 0x11c}, 0x1, 0x0, 0x0, 0x4040001}, 0x801) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020731af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x9}, 0x94) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x30, 0x4}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000004c0)={0x1, 0xd, 0x800081}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x0, 0x2, 0xfffffffe}]}, 0x10) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x6, 0x0, 0x1, 0x7}, 0x14) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b032200eb1025120212475400903e3bb1000000080086dd4803", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000740)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000002}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xa8, 0x0, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@CTA_NAT_SRC={0x6c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1800}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0x1, 0x4aa, 0x2, 0xf, 0x5, 0x70, 0xd9b0]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$sock_netdev_private(r6, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x81, 0x7f, 0x9, 0xfffffff4}, {0x5, 0x8, 0x4e, 0x22}]}, 0x10) executing program 32: capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x0, 0xe, 0x80000000}) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) capset(&(0x7f0000000100)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000140)={0x40, 0xfff, 0x1, 0x1, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0100000001050a0000000000000000010000049800018006000340000200002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffe00000022c00018014000300fc020000000000000000000000000000140004000000000000000000000000000000000106000340000200002c00018014000300fc00000000000000000000000000000114000400000000000000ffffac1414aa2c000d8014000500fe8000000000000000000000000000aa14000400fe8800000000000000000000000000013c00188008000240fffffffc080003400000080008000240000000030800034000000101080003400000000808000340000010000800014000006edb0600124000010000"], 0x11c}, 0x1, 0x0, 0x0, 0x4040001}, 0x801) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000000000000000000008510000001000000950000000000000018010000202073250000000000202020731af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x9}, 0x94) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x30, 0x4}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000004c0)={0x1, 0xd, 0x800081}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x0, 0x2, 0xfffffffe}]}, 0x10) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x6, 0x0, 0x1, 0x7}, 0x14) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b032200eb1025120212475400903e3bb1000000080086dd4803", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000740)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000002}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xa8, 0x0, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@CTA_NAT_SRC={0x6c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1800}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0x1, 0x4aa, 0x2, 0xf, 0x5, 0x70, 0xd9b0]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$sock_netdev_private(r6, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x81, 0x7f, 0x9, 0xfffffff4}, {0x5, 0x8, 0x4e, 0x22}]}, 0x10) executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x4, 0x4}, {0x6, 0x0, 0xfe, 0x4}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x13b242, 0x12d) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd8, 0x453, 0x20, 0x70bd2c, 0x25dfdbfc, "30ecfab63baeaad8d58f5d7b664e4f263d5a2810a88ab4b88fe019ad78c0426c079e6f8b4488889c2097ed75fae6342855bf6361d773c2bb93f8655a4848e2aac1e5c69d6aef058481a2b49c7a46f4d325b05c2c0aea925680812eb8383cf8466c1b61673a711e877ce88e10b82ea0efdc9a2cf4ebe880b4277c9089bad507aa60e43e43059509b505cf1959e628756429f52a8a9b210fc3d5e9aa9ca6716e930e350946e79b22f47581c90429689288c2db90ae9ff14a7edbe290ff4d4ebc4b97e332fec4", ["", "", "", "", "", "", ""]}, 0xd8}, 0x1, 0x0, 0x0, 0x24040004}, 0x4014) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x1000, @loopback}, {0xa, 0x0, 0x0, @mcast2}, r2, 0x2}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000c40)={0xc, 0x8, 0xfa00, {&(0x7f0000000ac0)}}, 0x10) fcntl$addseals(r0, 0x409, 0x1) executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x1) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$poke(0x2, r4, &(0x7f00000011c0), 0xfffffffffffffffd) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffdfff, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x3, 0x7, 0x4, 0x200}, 0x9, 0x1, 0x6, 0x2, 0x3, 0x19, 0x9, 0x18, 0x1, 0xfff, {0x0, 0xffffff80, 0x2, 0x9, 0x2e571574, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000041}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x3}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x30, 0x2, [@TCA_U32_CLASSID={0x8}, @TCA_U32_SEL={0x24, 0x5, {0xc, 0x6, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0xebd, 0x1, 0x206, 0x7}]}}]}}]}, 0x5c}}, 0x24040084) executing program 5: r0 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x6, 0x100000c, 0x8010, 0xffffffffffffffff, 0x20000000) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, 0x0) syz_ublk_setup_io_uring(0x5291, &(0x7f0000000040)={0x0, 0x16f1, 0x800, 0x1, 0x323}, &(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000280)) syz_io_uring_submit$UBLK(r0, r2, 0x0, &(0x7f0000000400)=@ublk_get_features_sqe={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0x80207513, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x8, &(0x7f00000003c0)}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x19, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @call={0x85, 0x0, 0x0, 0xf}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f00000013c0), 0x0, &(0x7f0000000100)=0x0, 0x0) r7 = syz_ublk_add_dev(r5, 0x0, r6, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f00000001c0)={[{}, {@i_version}, {@errors_remount}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x5}}]}, 0x1, 0x4d5, &(0x7f0000000a00)="$eJzs3c1rHOcZAPBndy1ZktX6o6XYLtQGF9wPrNUHxVJbKD21PRhKXXppwVWltepqpRXalWsJH+T25kMPJSGBkEPu+QtyiU8xgZBzQq4hh+CQOAokgcCGnd2V9bErbxx5V9b8fjCemXfW+7yvlufdmXdmdgJIrfO1fzIRwxHxdkQcr69uf8H5+mzj4e2Z2pSJavXqx5nkdbX15kub/+9YRKxHxEBE/Ol3Ef/I7I5bXl2bny4WC8uN9XxlYSlfXl27dGNheq4wV1gcm7w8NTU5OjE+tW9tvfu/f9298tof+l/9/L8P7v//jddr1RpubNvajv1Ub3pfnNxSdiQifv00gvVArtGewV5XhCdS+/y+FxEXkvw/Hrnk0wTSoFqtVr+qHt1RuvmFvV4FDq1ssg+cyY5ERH05mx0Zqe/Dfz+GssVSufLz66WVxdn6vvKJ6Mtev1EsjDaOFU5EX6a2PpYsP1of37E+EZHsAz+XG0zWR2ZKxdnud3fAFsd25P9nuXr+AynhkB/SS/5Desl/SC/5D+kl/yG95D+kl/yH9JL/kF7yH9JL/kN67ZX//V2sB9BVf7xypTZVm/e/z95cXZkv3bw0WyjPjyyszIzMlJaXRuZKpbli4c87bxNsoVgqLY39IlZu5SuFciVfXl27tlBaWaxcS+7rv1bo60KbgM6cPHfv3UxErP9yMJliy1e+XIXDrVrNRK/vQQZ6I9frDgjoGUP/kF7f4Bi/g9E/4FnU4id6txloXfybWHoq4YAuyPa6AkDPXDzj/B+klfF/SC/j/5Be9vGBJxz/j8eN/+tf4OAy/g/pNdzm+V/f2fLsrtGI+G5EvJPrO9p81hdwGGQ/zDT2/y8e//Hwzq39mS+SUwT9EfHvl66+cGu6Uskk5Z9sllderJcvj/ei/kCnmnmazH2RA0CqbTy8PdOcuhn3o9/WL0LYHf9IY2xyIDmHMLSR2XatQmafrl1YvxMRp1vFzzSed14/8zG0kdsV/1Rjnqm/RVLfI8lz07sT/8yW+D/aEv/st/6rQDrcq/U/o63yL5vkdGzm3/b+Z3ifzm227/+ym/1frk3/d27bO623jfHPl//zQdv4dyLOtozfjDeQxNoZv1a3ix228cHf/vKDdtuqr9Tfp1X8ptpSvrKwlC+vrl1KfkdurrA4Nnl5ampydGJ8Kp+MUeebI9W7/er0W/f3av9Qm/j19r7Xsv21sp922P4vf/jmX8/vEf8nF1p//qeSeeu//2BE/KzD+J+Ov//3dttq8WfbtD+7R/xa2USH8cvP/969wwBwgJRX1+ani8XCsoWDvzB4MKphIQ0Lj+s52h9vAs+GR0nf65oAAAAAAAAAAAAAnerG5cS9biMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGHwdQAAAP//2SbWag==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) socket$unix(0x1, 0x1, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="120100"], 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) futex(&(0x7f00000002c0), 0x1, 0x1, 0x0, 0x0, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), r7, 0x2) executing program 4: futex(&(0x7f0000001cc0), 0x5, 0x0, 0x0, &(0x7f0000000100)=0xfffffffd, 0xaffffff8) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0xfffffffffffffef3, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x100, 0x46951}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x1}, @IFLA_GENEVE_TTL_INHERIT={0x5}]}}}, @IFLA_LINK_NETNSID={0x0, 0x25, 0x4}]}, 0x58}}, 0x2000000) executing program 4: syz_mount_image$ext4(&(0x7f0000000080)='ext2\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f0000000b80)={[{@test_dummy_encryption}], [{@subj_role={'subj_role', 0x3d, 'dont_appraise'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@smackfshat}, {@dont_appraise}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x8, &(0x7f0000004380)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000050000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7235f1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a49bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5}, 0x94) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="680000001800050602000000000000000a400000fe040001000000001400010020010db800a000000000000000000001080006000001000008000400010000000600150003000000200016800c0001001234567890abcdef0500080001000000f5eb05ff52cebdd3", 0x68) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) unshare(0x60600) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000240), 0x802, 0x0) ioctl$UI_DEV_CREATE(r5, 0x5501) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat(r5, &(0x7f0000000000)='./file0\x00', 0x0, 0x40) (async) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e0001000000000000000000040100800c0002000000000000000000140001000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c94ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767fc734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, 0x0) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000380)={0x8, @win={{0x0, 0x8, 0x9, 0x8}, 0x3, 0x9c33, &(0x7f0000000340)={{0x7, 0xffffffcc, 0x6bb5, 0x9}, &(0x7f0000000300)={{0x6, 0x7fff, 0x0, 0x7ffffffd}, &(0x7f0000000180)={{0x480000, 0x100, 0x5, 0x2}}}}, 0x101, &(0x7f0000000480)="88ef61ba5df9537a4e2d8e50f5201a54340351b58aa5cab0eddf24f2d44e0c0600000000000000eb3c5b99ef0203efabc91b9d32537a49dd460f969433890e93f2b06478dc04407ee6321533406497959063ec3b8db13f728c0a24ffa3b44b171ab19f8604bc0bf3baea5ba04b443ed837a9191b32a3e91333beeb69b0a63cbf76aad4630ee8643eb061b62a64f5a8c3d1555462182a26b41a3d74b32f6499dfe01926f6d3e2b5593f2aa13aabb33ce5af5924182b186f01e07fc05c39fac762db8e1ebbe4850fabd5ec8acc", 0xf7}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000580), &(0x7f00000005c0)=0x4) (async) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0xfffffffffffffe17) (async) sendmmsg$unix(r9, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r8, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e20, 0x8, @loopback, 0x4}, 0x1c) executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) (async) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) (async) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) (async) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) setns(r2, 0x24020000) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) setgroups(0x0, 0x0) setuid(0xee00) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setresgid(0xee00, 0xee01, 0x0) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) setns(r2, 0x24020000) (async) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setgroups(0x0, 0x0) (async) setuid(0xee00) (async) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) (async) executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) chdir(&(0x7f0000000080)='./file0\x00') socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) (async) chdir(&(0x7f0000000080)='./file0\x00') (async) executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000001c0)={0x1}, 0x8) sendmmsg$sock(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="dce4c739", 0x4}], 0x1}}], 0x1, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000100000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x9}, 0x94) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000200)={0x2, 0x1234, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x48, 0x1, 0x0, @rand_addr=0x64010102, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x1234, 0x1}}}}}, 0x0) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x2, 0x6, 0x8, 0x7f}, 'syz1\x00', 0x56}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r1, r4, 0x3, 0x0, @val=@iter={0x0}}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) sendto$inet6(r5, 0x0, 0x0, 0x240088d1, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1f}, 0x1c) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x7f, 0x3f381aebd606354e, 0x4, "", [{{0x9, 0x4, 0x0, 0xf1, 0x22, 0x2, 0x6, 0x0, 0xd, {{0x5}, {0x5, 0x24, 0x0, 0x9276}, {0xd, 0x24, 0xf, 0x1, 0x7ff, 0x1, 0xf, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x5f, 0xc, 0x7f}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5, 0x9, 0x8}}}}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) executing program 5: setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x438, 0x240, 0x240, 0x0, 0x350, 0x370, 0x350, 0x4, 0x0, {[{{@arp={@private, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_to_batadv\x00', 'batadv0\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "bc2e329885ea3654891fbae8c6c66e07212432bde429bcda7deb48d85c6f5e269c2021c8f8dc09af0b3f2e10e8ac79cc67e264613c4be6838ee2daacf7926a6e"}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr, @broadcast}}}, {{@arp={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x488) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c) (async) syz_emit_ethernet(0x3a, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x10, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x8, 0x2000000000004}}}}}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)={@fallback, r1, 0x36, 0x202c}, 0x20) recvmmsg(r0, &(0x7f0000000040), 0x400000000000338, 0x2, 0x0) executing program 3: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f000004f000/0x800000)=nil, 0x800000, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000003180)=""/4112, &(0x7f0000000000)=0x1010) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f00005e3000/0x3000)=nil, 0x3000}, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x1c, r0, 0x303, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20044080}, 0x20040890) r2 = getpid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x200801, &(0x7f0000000380)=ANY=[], 0x1, 0x1c8, &(0x7f0000000ac0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbQTQ7A8NCKL/ilva6Naf8zpz01NVaJsvM0OqpLY8sJpfaY+QmuZhHgpkhNPXIouLKquzEnJzUouKFDBW3kpMqTp9gYLluf02lWSKcF2Kigw7TER+PrBmNJZyTpDTF2NgyFc6e+SC/jk3jCMOjFcwb6zzzGusKU6fmpeUlVWVVZc2bOHHjzMbOxsaVE+ui0vxWMbakuGxq6mRkctiiJrCZ2VB9ko32hHftqx4mObD2ePg1nzJWep3KwmDMyiZ1akXVzAlflGYzGn5nuMPzHwokLBpMOPkhjrmVnNLAkHYxjJGDgYGhbcuZOSHM/GxuCxRakk8whR7lWDpTwuKAUNXJn5aabx0S3WZse+rAdobn8HGeNQV9gkbHJRicFgr+lwH5NKGhoUxjLdNS2wVfijT+SnitNnbKYHC3Z1raDA1IlgYQuRLKkwXrSUhe4aGjqWmUkpzQsEnCM4SBwVCZYeseztUCDQxI0abCwMCwnREWtxBwjY1hFIyCUTAKRsEoGAWjYBSMglEwCkbBCAKAAAAA//+BbpcE") setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x6000000}, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) shutdown(r5, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x28, 0x10, 0x400, 0x0, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x92e2b7a147cfdc67, 0x21020}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0x6}]}, 0x28}}, 0x8000) executing program 3: syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="dcfffffffdc477f6bbbbbbbb08004500007800a40897e7010102ac1414aa03049078010000004700000000000000001100000000000000000000440c0001ac1414bb4e210000443c0001ac1414aa000000000000000000000000ac1414000000000000000000000000010000000000000000ac1e000100000000acd6709c1e5b25233a8b81104ccddd4551a2d96d5a42c85ff51bd977d30366b6358925e2145d74cbef7ffecf07a4762b8c54a107e8e9a749e0d5b539cc98a966392af1d1e3acec4ecf390f1f47f91f4b73dd65985b487379b3dd6796c08d183eb10c453b8872503ac5bbe60ab79f427cedcf398aed80048c627edeb98f46b1fdd6a8f542ccb48524da4a094aa274f930fd986e26a9c1ac2f0e86ac06cc2578de49a7e6a7316192376106d85d798dd1a77b3fc9de2aabf1f796b535a708420f0ce13c1b4747000000000000000000000001c5407e4e401210c63e292e418972dede0a25978c07cb36932a28e225aad29940a76dd5a7246f753e840d98e24623316da93cac00f1d0bf4a0fe0404fd7d679115b7160f45a6acbf99cb649ab0fb6105ccfb3376f1ff82b80fb5503f2a332f08619b285570359a39fcdab8376397f52de0d78dec6022b8704080132f74f10b294355fae7b0a24a8f8cf0aaa4a3344ab63324e0d41ec60730f0d236f76c0e7dd5c8474d2b17831a980302f8abb7830e85bc2d5ece69b37e9b9"], 0x0) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x109882, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x169883, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x64) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 40, 5, 24, 24, 22, 18, 8, 11, 29, 1, 7, 30] detailed listing: executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) (async) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) (async) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) (async) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) setns(r2, 0x24020000) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) setgroups(0x0, 0x0) setuid(0xee00) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setresgid(0xee00, 0xee01, 0x0) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) setns(r2, 0x24020000) (async) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setgroups(0x0, 0x0) (async) setuid(0xee00) (async) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) (async) executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) chdir(&(0x7f0000000080)='./file0\x00') socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) (async) chdir(&(0x7f0000000080)='./file0\x00') (async) executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000001c0)={0x1}, 0x8) sendmmsg$sock(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="dce4c739", 0x4}], 0x1}}], 0x1, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000100000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x9}, 0x94) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000200)={0x2, 0x1234, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x48, 0x1, 0x0, @rand_addr=0x64010102, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x1234, 0x1}}}}}, 0x0) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x2, 0x6, 0x8, 0x7f}, 'syz1\x00', 0x56}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r1, r4, 0x3, 0x0, @val=@iter={0x0}}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) sendto$inet6(r5, 0x0, 0x0, 0x240088d1, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1f}, 0x1c) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x7f, 0x3f381aebd606354e, 0x4, "", [{{0x9, 0x4, 0x0, 0xf1, 0x22, 0x2, 0x6, 0x0, 0xd, {{0x5}, {0x5, 0x24, 0x0, 0x9276}, {0xd, 0x24, 0xf, 0x1, 0x7ff, 0x1, 0xf, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x5f, 0xc, 0x7f}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5, 0x9, 0x8}}}}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) executing program 5: setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x438, 0x240, 0x240, 0x0, 0x350, 0x370, 0x350, 0x4, 0x0, {[{{@arp={@private, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_to_batadv\x00', 'batadv0\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "bc2e329885ea3654891fbae8c6c66e07212432bde429bcda7deb48d85c6f5e269c2021c8f8dc09af0b3f2e10e8ac79cc67e264613c4be6838ee2daacf7926a6e"}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr, @broadcast}}}, {{@arp={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x488) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c) (async) syz_emit_ethernet(0x3a, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x10, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x8, 0x2000000000004}}}}}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)={@fallback, r1, 0x36, 0x202c}, 0x20) recvmmsg(r0, &(0x7f0000000040), 0x400000000000338, 0x2, 0x0) executing program 3: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f000004f000/0x800000)=nil, 0x800000, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000003180)=""/4112, &(0x7f0000000000)=0x1010) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f00005e3000/0x3000)=nil, 0x3000}, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x1c, r0, 0x303, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20044080}, 0x20040890) r2 = getpid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x200801, &(0x7f0000000380)=ANY=[], 0x1, 0x1c8, &(0x7f0000000ac0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbQTQ7A8NCKL/ilva6Naf8zpz01NVaJsvM0OqpLY8sJpfaY+QmuZhHgpkhNPXIouLKquzEnJzUouKFDBW3kpMqTp9gYLluf02lWSKcF2Kigw7TER+PrBmNJZyTpDTF2NgyFc6e+SC/jk3jCMOjFcwb6zzzGusKU6fmpeUlVWVVZc2bOHHjzMbOxsaVE+ui0vxWMbakuGxq6mRkctiiJrCZ2VB9ko32hHftqx4mObD2ePg1nzJWep3KwmDMyiZ1akXVzAlflGYzGn5nuMPzHwokLBpMOPkhjrmVnNLAkHYxjJGDgYGhbcuZOSHM/GxuCxRakk8whR7lWDpTwuKAUNXJn5aabx0S3WZse+rAdobn8HGeNQV9gkbHJRicFgr+lwH5NKGhoUxjLdNS2wVfijT+SnitNnbKYHC3Z1raDA1IlgYQuRLKkwXrSUhe4aGjqWmUkpzQsEnCM4SBwVCZYeseztUCDQxI0abCwMCwnREWtxBwjY1hFIyCUTAKRsEoGAWjYBSMglEwCkbBCAKAAAAA//+BbpcE") setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x6000000}, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) shutdown(r5, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x28, 0x10, 0x400, 0x0, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x92e2b7a147cfdc67, 0x21020}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0x6}]}, 0x28}}, 0x8000) executing program 3: syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="dcfffffffdc477f6bbbbbbbb08004500007800a40897e7010102ac1414aa03049078010000004700000000000000001100000000000000000000440c0001ac1414bb4e210000443c0001ac1414aa000000000000000000000000ac1414000000000000000000000000010000000000000000ac1e000100000000acd6709c1e5b25233a8b81104ccddd4551a2d96d5a42c85ff51bd977d30366b6358925e2145d74cbef7ffecf07a4762b8c54a107e8e9a749e0d5b539cc98a966392af1d1e3acec4ecf390f1f47f91f4b73dd65985b487379b3dd6796c08d183eb10c453b8872503ac5bbe60ab79f427cedcf398aed80048c627edeb98f46b1fdd6a8f542ccb48524da4a094aa274f930fd986e26a9c1ac2f0e86ac06cc2578de49a7e6a7316192376106d85d798dd1a77b3fc9de2aabf1f796b535a708420f0ce13c1b4747000000000000000000000001c5407e4e401210c63e292e418972dede0a25978c07cb36932a28e225aad29940a76dd5a7246f753e840d98e24623316da93cac00f1d0bf4a0fe0404fd7d679115b7160f45a6acbf99cb649ab0fb6105ccfb3376f1ff82b80fb5503f2a332f08619b285570359a39fcdab8376397f52de0d78dec6022b8704080132f74f10b294355fae7b0a24a8f8cf0aaa4a3344ab63324e0d41ec60730f0d236f76c0e7dd5c8474d2b17831a980302f8abb7830e85bc2d5ece69b37e9b9"], 0x0) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x109882, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x169883, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x64) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-socket$key-sendmsg$key-ioctl$KDSETMODE-ioctl$KDSETMODE-gettid-timer_create-syz_init_net_socket$nfc_llcp-bind$nfc_llcp-socket$inet6_sctp-socket$inet6_sctp-connect$inet6-shutdown-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO-getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS-sendto-socket$nl_generic-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-mmap-mbind-mmap-mbind-socket$kcm-sendmsg$kcm-timer_settime-syz_open_dev$tty1-ioctl$TIOCSWINSZ detailed listing: executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash bisect: split chunks (needed=true): <12> bisect: split chunk #0 of len 12 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 8, 11, 29, 1, 7, 30] detailed listing: executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000001c0)={0x1}, 0x8) sendmmsg$sock(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="dce4c739", 0x4}], 0x1}}], 0x1, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000100000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x9}, 0x94) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f0000000200)={0x2, 0x1234, @local}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000580)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x48, 0x1, 0x0, @rand_addr=0x64010102, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x1234, 0x1}}}}}, 0x0) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x2, 0x6, 0x8, 0x7f}, 'syz1\x00', 0x56}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r1, r4, 0x3, 0x0, @val=@iter={0x0}}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) sendto$inet6(r5, 0x0, 0x0, 0x240088d1, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1f}, 0x1c) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x7f, 0x3f381aebd606354e, 0x4, "", [{{0x9, 0x4, 0x0, 0xf1, 0x22, 0x2, 0x6, 0x0, 0xd, {{0x5}, {0x5, 0x24, 0x0, 0x9276}, {0xd, 0x24, 0xf, 0x1, 0x7ff, 0x1, 0xf, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x5f, 0xc, 0x7f}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x5, 0x9, 0x8}}}}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) executing program 5: setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x438, 0x240, 0x240, 0x0, 0x350, 0x370, 0x350, 0x4, 0x0, {[{{@arp={@private, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_to_batadv\x00', 'batadv0\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "bc2e329885ea3654891fbae8c6c66e07212432bde429bcda7deb48d85c6f5e269c2021c8f8dc09af0b3f2e10e8ac79cc67e264613c4be6838ee2daacf7926a6e"}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr, @broadcast}}}, {{@arp={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x488) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c) (async) syz_emit_ethernet(0x3a, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x10, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x8, 0x2000000000004}}}}}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000540)={@fallback, r1, 0x36, 0x202c}, 0x20) recvmmsg(r0, &(0x7f0000000040), 0x400000000000338, 0x2, 0x0) executing program 3: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f000004f000/0x800000)=nil, 0x800000, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000003180)=""/4112, &(0x7f0000000000)=0x1010) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000140)={{&(0x7f00005e3000/0x3000)=nil, 0x3000}, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x3800, 0x3}) socket$inet(0x2, 0x2, 0x1) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000005c0)={0x1c, r0, 0x303, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20044080}, 0x20040890) r2 = getpid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x20000090) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, 0x0) syz_mount_image$squashfs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x200801, &(0x7f0000000380)=ANY=[], 0x1, 0x1c8, &(0x7f0000000ac0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbQTQ7A8NCKL/ilva6Naf8zpz01NVaJsvM0OqpLY8sJpfaY+QmuZhHgpkhNPXIouLKquzEnJzUouKFDBW3kpMqTp9gYLluf02lWSKcF2Kigw7TER+PrBmNJZyTpDTF2NgyFc6e+SC/jk3jCMOjFcwb6zzzGusKU6fmpeUlVWVVZc2bOHHjzMbOxsaVE+ui0vxWMbakuGxq6mRkctiiJrCZ2VB9ko32hHftqx4mObD2ePg1nzJWep3KwmDMyiZ1akXVzAlflGYzGn5nuMPzHwokLBpMOPkhjrmVnNLAkHYxjJGDgYGhbcuZOSHM/GxuCxRakk8whR7lWDpTwuKAUNXJn5aabx0S3WZse+rAdobn8HGeNQV9gkbHJRicFgr+lwH5NKGhoUxjLdNS2wVfijT+SnitNnbKYHC3Z1raDA1IlgYQuRLKkwXrSUhe4aGjqWmUkpzQsEnCM4SBwVCZYeseztUCDQxI0abCwMCwnREWtxBwjY1hFIyCUTAKRsEoGAWjYBSMglEwCkbBCAKAAAAA//+BbpcE") setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x6000000}, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) shutdown(r5, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x28, 0x10, 0x400, 0x0, 0x4000, {0x0, 0x0, 0x0, 0x0, 0x92e2b7a147cfdc67, 0x21020}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0x6}]}, 0x28}}, 0x8000) executing program 3: syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="dcfffffffdc477f6bbbbbbbb08004500007800a40897e7010102ac1414aa03049078010000004700000000000000001100000000000000000000440c0001ac1414bb4e210000443c0001ac1414aa000000000000000000000000ac1414000000000000000000000000010000000000000000ac1e000100000000acd6709c1e5b25233a8b81104ccddd4551a2d96d5a42c85ff51bd977d30366b6358925e2145d74cbef7ffecf07a4762b8c54a107e8e9a749e0d5b539cc98a966392af1d1e3acec4ecf390f1f47f91f4b73dd65985b487379b3dd6796c08d183eb10c453b8872503ac5bbe60ab79f427cedcf398aed80048c627edeb98f46b1fdd6a8f542ccb48524da4a094aa274f930fd986e26a9c1ac2f0e86ac06cc2578de49a7e6a7316192376106d85d798dd1a77b3fc9de2aabf1f796b535a708420f0ce13c1b4747000000000000000000000001c5407e4e401210c63e292e418972dede0a25978c07cb36932a28e225aad29940a76dd5a7246f753e840d98e24623316da93cac00f1d0bf4a0fe0404fd7d679115b7160f45a6acbf99cb649ab0fb6105ccfb3376f1ff82b80fb5503f2a332f08619b285570359a39fcdab8376397f52de0d78dec6022b8704080132f74f10b294355fae7b0a24a8f8cf0aaa4a3344ab63324e0d41ec60730f0d236f76c0e7dd5c8474d2b17831a980302f8abb7830e85bc2d5ece69b37e9b9"], 0x0) executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x109882, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000100)=0x10000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x169883, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x64) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 40, 5, 24, 24, 22, 30] detailed listing: executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) (async) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) (async) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) (async) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) setns(r2, 0x24020000) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) setgroups(0x0, 0x0) setuid(0xee00) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setresgid(0xee00, 0xee01, 0x0) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) setns(r2, 0x24020000) (async) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setgroups(0x0, 0x0) (async) setuid(0xee00) (async) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) (async) executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) chdir(&(0x7f0000000080)='./file0\x00') socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) (async) chdir(&(0x7f0000000080)='./file0\x00') (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 24, 22, 30] detailed listing: executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) sendmmsg$unix(r3, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000b40)="df11f33dba9c566010f90f2351d877d67f2d8f948973326afb", 0x19}], 0x1, 0x0, 0x0, 0x800}}], 0x1, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) (async) recvmsg$unix(r2, &(0x7f0000002480)={0x0, 0x0, 0x0}, 0x42) (async) recvmsg$can_j1939(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000000600)=""/17, 0x11}, {&(0x7f0000000640)=""/65, 0x41}], 0x2}, 0x121) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f00000000c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}, {@nofavordynmods}]}) (async) executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) setns(r2, 0x24020000) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) setgroups(0x0, 0x0) setuid(0xee00) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setresgid(0xee00, 0xee01, 0x0) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="5d5800000000df260ba730b5a4be00001400168010000980040007000200000000000100140003006970766c61f43000"], 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) setns(r2, 0x24020000) (async) syz_clone(0x301e8c00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setgroups(0x0, 0x0) (async) setuid(0xee00) (async) shmget$private(0x0, 0x4000, 0x78000c04, &(0x7f0000ff9000/0x4000)=nil) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x36}}, @in={0x2, 0x4e29, @dev={0xac, 0x14, 0x14, 0x31}}]}, &(0x7f00000002c0)=0x10) (async) executing program 5: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) chdir(&(0x7f0000000080)='./file0\x00') socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x4, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x1a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x804, 0x0, 0xff, 0x0, 0x45, [0x7fffffff]}}) (async) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, &(0x7f0000000040)={0x2, r3, 0x5, 0x5, 0x7, 0x5, 0x3, 0x7, 0xe}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r4, &(0x7f0000000640)={@void, @void, @ipv6=@icmpv6={0x3, 0x6, "31fddf", 0x106, 0x3a, 0x0, @mcast2, @remote, {[@fragment={0x3a, 0x0, 0x8, 0x0, 0x0, 0x15, 0x67}, @dstopts={0x3c}], @ndisc_na={0x88, 0x0, 0x0, 0x1, '\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [{0x2, 0x9, "6b42f6d09495b7b0cad87fa7672114dcb0485de91102719e7861ec64ee0f5c6c02ee8e9e4d7b1214679cc2af8f1bd9856a6ff80ff9886ee86c6615d8515f14444f8b6d6987921217ee"}, {0x1f, 0x12, "bf5ea30b00891141873fed67d4e20ea5efb1deb62dc7af4a38ebf65ce947cab0485cc7a324046d7c535ee9b804ae1e7bff1e6b48b5f0829273251caeeb3a16ba00b4558baff16dfe2cf181be08ed8797ee8bb0387326d69867b612c84e6a37560f762647897d5ce639e6af5805202291eb08c63c65612ef3c44da5f9fd60cd0615ac715ca3d7d9ac30ced34dc37191"}, {0x19}]}}}}, 0x12e) (async) chdir(&(0x7f0000000080)='./file0\x00') (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 40, 5, 30] detailed listing: executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30] detailed listing: executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x1a, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x0) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 40, 30] detailed listing: executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)={0x0, 0x0}) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) r3 = socket$inet(0x2, 0xa, 0x8831) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000600)={0x4, &(0x7f00000005c0)=[{0xfff, 0x3, 0x6, 0x1}, {0x81, 0x2, 0x7f, 0x7}, {0x8, 0x7, 0x7f}, {0x81, 0xa, 0x2}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000640)) (async) move_pages(r2, 0x8, &(0x7f0000000200)=[&(0x7f0000002000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil], &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x0], 0x2) (async) write$vhost_msg_v2(r0, &(0x7f0000001140)={0x2, 0x0, {0x0, 0x0, 0x0, 0x3, 0x3}}, 0x48) (async) socket$inet(0x2, 0xa, 0x8831) (async) getsockopt$sock_buf(r3, 0x1, 0x3b, 0x0, 0x0) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000500)={{r0, &(0x7f0000000000)='/dev/vhost-net\x00', 0x408282, &(0x7f0000000040)={@_ha_fsid={[0x8f99, 0xb]}, {0x9, 0x6, 0x1, 0x9}}, 0x937, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000400)=0x3}, {[0x3, 0x8, 0xfffffcba, 0x8]}, 0x0, 0xa4, &(0x7f0000000440)=""/164}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000580)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380b625d3f356046c6e233bbe60000001000390425bd7000fcdbdf2510000000bb7213395f85c83c6569c373bd37eb4e6432affee3a60957a32bc7cd8c2e182758685181d70dba442519778ec244560926e97caad5b55d2bdd218a0ff6daa3b1e518fe681a0a90f29a61bec90d5cd14b805927a4ee10e1ec0e2cd3784d96fd4d229e206e5d2a3027446be5f0aa58bb3a7d699a74f7ddaa57c51745761d4ab891e96d14e631cca0d3c7c07f977a56d041a9995c665afd3ad423dccf1c2257e72be89855380a6e3ca72790bf3606bf65858d3a0d0c7822804ccce748edc25c335fd1364b1607ca255b006490a467ea67eed55d02bd", @ANYRES32=0x0, @ANYBLOB="1000000000100000180012800800010067726500080002800600030004000000000016000200000000001200"], 0x38}}, 0x0) (async) executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 30] detailed listing: executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [39, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r2) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r7, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f00000003c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [38, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [37, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [36, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [36, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) (async) write(0xffffffffffffffff, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [36, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [35, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [34, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [33, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [32, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [31, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/netdevsim/netdevsim0/max_vfs\x00', 0x1, 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00', 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f00000010c0), r1) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000d80)={'wpan1\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)='1\n\x00', 0x2) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/hibernate_compression_threads', 0x10b080, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 30] detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30] detailed listing: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 30] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r11, 0x5414, &(0x7f0000000040)={0x218, 0x8, 0x75, 0x6}) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug minimized 40 calls -> 4 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 29] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 28] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 27] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704fe0180fc5409000c00", 0x33fe0}], 0x1}, 0x0) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 26] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) socket$kcm(0x10, 0x2, 0x10) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4000, 0x0, 0x1, 0x2) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 24] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) mmap(&(0x7f0000378000/0x4000)=nil, 0x4000, 0x2, 0x8031, 0xffffffffffffffff, 0xbf069000) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 23] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0xfffffffffffff, 0x0) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 22] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 21] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200051b08000300ac1414aa0800060021"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 20] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r8) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 19] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 18] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) sendto(r3, &(0x7f00000005c0)="a1bfc48ba9", 0xfdef, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 17] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) r4 = socket$inet6_sctp(0xa, 0x4, 0x84) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r5, 0x1) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r7}, 0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000000c0)={r7, 0x6, 0x0, 0x2, 0x5}, &(0x7f00000001c0)=0x18) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 16] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r4, 0x1) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000b00)={0x3, 0x4, 0x8006, 0x5, r6}, 0x10) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 15] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r4, 0x1) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 14] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r4, 0x1) socket$inet_sctp(0x2, 0x1, 0x84) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 13] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) shutdown(r4, 0x1) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 12] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) socket$inet6_sctp(0xa, 0x801, 0x84) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) socket$inet6_sctp(0xa, 0x4, 0x84) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) gettid() r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) socket$key(0xf, 0x3, 0x2) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2] detailed listing: executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) executing program 0: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug minimized 30 calls -> 2 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug bisect: concatenation succeeded found reproducer with 6 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500), 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in corrupted a never seen crash title: KASAN: slab-out-of-bounds Read in corrupted, ignore testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-syz_init_net_socket$nfc_llcp-bind$nfc_llcp detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)=' +p\n\x00'/18, 0x12) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) program crashed: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug validation run: crashed=true reproducing took 1h54m54.762673777s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 lib/vsprintf.c:648 Read of size 1 at addr ffff0000d0cf899c by task syz.0.17/4947 CPU: 1 UID: 0 PID: 4947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 string_nocheck+0xd8/0x140 lib/vsprintf.c:648 string+0x8c/0xc8 lib/vsprintf.c:730 vsnprintf+0x880/0xd10 lib/vsprintf.c:2945 va_format lib/vsprintf.c:1725 [inline] pointer+0x5e8/0x6b4 lib/vsprintf.c:2573 vsnprintf+0x618/0xd10 lib/vsprintf.c:2949 vprintk_store+0x344/0xb94 kernel/printk/printk.c:2307 vprintk_emit+0x1bc/0x514 kernel/printk/printk.c:2455 vprintk_default+0x54/0x80 kernel/printk/printk.c:2494 vprintk+0x9c/0x114 kernel/printk/printk_safe.c:82 _printk+0xe0/0x130 kernel/printk/printk.c:2504 __dynamic_pr_debug+0x148/0x1e4 lib/dynamic_debug.c:879 nfc_llcp_wks_sap net/nfc/llcp_core.c:344 [inline] nfc_llcp_get_sdp_ssap+0x350/0x3fc net/nfc/llcp_core.c:420 llcp_sock_bind+0x2e0/0x58c net/nfc/llcp_sock.c:114 __sys_bind_socket net/socket.c:1920 [inline] __sys_bind+0x1c4/0x268 net/socket.c:1951 __do_sys_bind net/socket.c:1956 [inline] __se_sys_bind net/socket.c:1954 [inline] __arm64_sys_bind+0x84/0x9c net/socket.c:1954 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Allocated by task 4947: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_node_track_caller_noprof+0x434/0x6d4 mm/slub.c:5471 kmemdup_noprof+0x44/0x8c mm/util.c:138 kmemdup_noprof include/linux/fortify-string.h:715 [inline] llcp_sock_bind+0x2b0/0x58c net/nfc/llcp_sock.c:107 __sys_bind_socket net/socket.c:1920 [inline] __sys_bind+0x1c4/0x268 net/socket.c:1951 __do_sys_bind net/socket.c:1956 [inline] __se_sys_bind net/socket.c:1954 [inline] __arm64_sys_bind+0x84/0x9c net/socket.c:1954 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the object at ffff0000d0cf8980 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes to the right of allocated 28-byte region [ffff0000d0cf8980, ffff0000d0cf899c) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110cf8 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c0001780 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d0cf8880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ffff0000d0cf8900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc >ffff0000d0cf8980: 00 00 00 04 fc fc fc fc 00 00 00 fc fc fc fc fc ^ ffff0000d0cf8a00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ffff0000d0cf8a80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in string_nocheck+0xd8/0x140 lib/vsprintf.c:648 Read of size 1 at addr ffff0000d0cf899c by task syz.0.17/4947 CPU: 1 UID: 0 PID: 4947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 string_nocheck+0xd8/0x140 lib/vsprintf.c:648 string+0x8c/0xc8 lib/vsprintf.c:730 vsnprintf+0x880/0xd10 lib/vsprintf.c:2945 va_format lib/vsprintf.c:1725 [inline] pointer+0x5e8/0x6b4 lib/vsprintf.c:2573 vsnprintf+0x618/0xd10 lib/vsprintf.c:2949 vprintk_store+0x344/0xb94 kernel/printk/printk.c:2307 vprintk_emit+0x1bc/0x514 kernel/printk/printk.c:2455 vprintk_default+0x54/0x80 kernel/printk/printk.c:2494 vprintk+0x9c/0x114 kernel/printk/printk_safe.c:82 _printk+0xe0/0x130 kernel/printk/printk.c:2504 __dynamic_pr_debug+0x148/0x1e4 lib/dynamic_debug.c:879 nfc_llcp_wks_sap net/nfc/llcp_core.c:344 [inline] nfc_llcp_get_sdp_ssap+0x350/0x3fc net/nfc/llcp_core.c:420 llcp_sock_bind+0x2e0/0x58c net/nfc/llcp_sock.c:114 __sys_bind_socket net/socket.c:1920 [inline] __sys_bind+0x1c4/0x268 net/socket.c:1951 __do_sys_bind net/socket.c:1956 [inline] __se_sys_bind net/socket.c:1954 [inline] __arm64_sys_bind+0x84/0x9c net/socket.c:1954 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Allocated by task 4947: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_node_track_caller_noprof+0x434/0x6d4 mm/slub.c:5471 kmemdup_noprof+0x44/0x8c mm/util.c:138 kmemdup_noprof include/linux/fortify-string.h:715 [inline] llcp_sock_bind+0x2b0/0x58c net/nfc/llcp_sock.c:107 __sys_bind_socket net/socket.c:1920 [inline] __sys_bind+0x1c4/0x268 net/socket.c:1951 __do_sys_bind net/socket.c:1956 [inline] __se_sys_bind net/socket.c:1954 [inline] __arm64_sys_bind+0x84/0x9c net/socket.c:1954 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the object at ffff0000d0cf8980 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes to the right of allocated 28-byte region [ffff0000d0cf8980, ffff0000d0cf899c) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110cf8 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c0001780 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d0cf8880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ffff0000d0cf8900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc >ffff0000d0cf8980: 00 00 00 04 fc fc fc fc 00 00 00 fc fc fc fc fc ^ ffff0000d0cf8a00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ffff0000d0cf8a80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc ==================================================================