Extracting prog: 21m19.595173209s Minimizing prog: 26m31.657234608s Simplifying prog options: 0s Extracting C: 1m47.083745738s Simplifying C: 17m29.664785756s extracting reproducer from 44 programs testing a last program of every proc single: executing 9 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend-ioctl$FE_READ_SIGNAL_STRENGTH detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) ioctl$FE_READ_SIGNAL_STRENGTH(r0, 0x80026f47, &(0x7f0000000200)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mknodat-nanosleep-openat-syz_usb_ep_write-close-syz_usb_disconnect detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-write$USERIO_CMD_REGISTER-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-write$USERIO_CMD_SEND_INTERRUPT-nanosleep detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$usbfs-ioctl$USBDEVFS_CLAIMINTERFACE-ioctl$USBDEVFS_BULK detailed listing: executing program 0: syz_usb_connect(0x0, 0x35, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000040ffffffff0001010200010902200001010080320904000002000000000905010240000009058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x4004550c, &(0x7f0000000180)) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000200)={{{0x1}}, 0x20, 0x3e8, &(0x7f0000000240)="0123456789abcdef0123456789abcdef"}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$video-ioctl$VIDIOC_S_FMT-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040790927020001000000010902270001010080320904000003ffffff00070503024000000705820240000007058402400000"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000300)={0x1, @pix={0x140, 0xf0, 0x30324c4a, 0x1}}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000400)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000500)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000600)=@mmap={0x1, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000700)=0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-syz_usb_connect-syz_usb_control_io$sierra_net-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-socket$rds-socket$inet6_sctp-syz_open_dev$I2C-ioctl$I2C_RDWR-sendmsg$inet-socket$kcm-sendmsg$IPVS_CMD_SET_INFO-socket-sendmsg$nl_route-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-socket$nl_route-sendmsg$nl_route-sendmsg$inet detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000140)={&(0x7f0000000040)=[{0x4, 0x1, 0x0, 0x0}, {0x204, 0xfa11, 0x3e, 0x0}], 0x2}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0xfffffffffffffce6}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_GROUP={0x8, 0x1b, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-syz_usb_connect-syz_usb_control_io$sierra_net-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-socket$rds-socket$inet6_sctp-syz_open_dev$I2C-ioctl$I2C_RDWR-sendmsg$inet-socket$kcm-sendmsg$IPVS_CMD_SET_INFO-socket-sendmsg$nl_route-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-socket$nl_route-sendmsg$nl_route-sendmsg$inet detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000140)={&(0x7f0000000040)=[{0x4, 0x1, 0x0, 0x0}, {0x204, 0xfa11, 0x3e, 0x0}], 0x2}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0xfffffffffffffce6}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_GROUP={0x8, 0x1b, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="91107cfe0000000095"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="91107cfe0000000095"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) program did not crash single: failed to extract reproducer bisect: bisecting 44 programs with base timeout 30s testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 29, 30, 15, 1, 1, 22, 29, 29, 22, 6, 21, 21, 2, 5, 4, 3, 2, 21, 2, 9, 8, 4, 6, 2, 17, 4, 5, 5, 6, 27, 5, 5, 8, 4, 2, 5, 1, 7, 8, 3, 2, 5] detailed listing: executing program 4: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000740)=ANY=[@ANYBLOB="00164c000000e5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201100100000040c50f80b0000000000001090224000100009009090400fe01030001000921c100fe0122280009058103"], 0x0) r2 = syz_usb_connect(0x0, 0x7a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004082057d0000000000000109026800030100c0000904000000010100000904000101010200000b2402010203180144ac00070501010002010904010000010100000904010101010200000b2402010203180144ac000705820100020109040200"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) shutdown(0xffffffffffffffff, 0x1) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000500)={0x2, 0x0, @ioapic={0xfec00000, 0x404, 0x1, 0x5, 0x0, [{0x7, 0xc, 0x4, '\x00', 0x38}, {0x3, 0xfe, 0x7c, '\x00', 0x2f}, {0x6, 0xb3, 0x1, '\x00', 0xd}, {0x5, 0x9, 0x1, '\x00', 0x16}, {0x5, 0x5, 0x6, '\x00', 0x79}, {0x7, 0x80, 0x0, '\x00', 0x6}, {0x4, 0x8, 0x1, '\x00', 0x47}, {0x52, 0x9, 0x48, '\x00', 0x7}, {0x6, 0x6, 0xab, '\x00', 0xff}, {0x1, 0xb6, 0x89, '\x00', 0x80}, {0x16, 0x24, 0xa5, '\x00', 0x1}, {0x7, 0x1, 0x7, '\x00', 0x8}, {0x6, 0xc, 0x5}, {0x19, 0x11, 0x8c, '\x00', 0x4}, {0x5, 0xc1, 0x7, '\x00', 0x6}, {0x8, 0x2, 0xcb, '\x00', 0x3}, {0x7, 0x6, 0xb, '\x00', 0x5}, {0x9, 0x0, 0xfa, '\x00', 0x5}, {0x6, 0x3, 0x7, '\x00', 0x6}, {0xf4, 0x8, 0x5, '\x00', 0xf8}, {0x4, 0x5, 0x31, '\x00', 0xf7}, {0x6, 0x7, 0xfe, '\x00', 0xa}, {0xff, 0x20, 0x3, '\x00', 0x7}, {0x16, 0x88, 0x4, '\x00', 0x8}]}}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3, 0x2, 0xa, 0x0, 0x613, 0xf, 0x81, 0x7, 0x6, 0x0, 0x77, 0x10, 0x0, 0x3, 0x7, 0x4, 0xd, 0x7, 0x5, '\x00', 0x8}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000480)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]}) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x3, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0xc) sendmsg$inet(r3, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) syz_usb_control_io$lan78xx(r2, &(0x7f0000001880)={0xc, &(0x7f0000001740)=ANY=[@ANYBLOB="2022c3000000c33137c1bf5c1e99a4ee56758e8cc660ad80f5c389356cd73bda3be5040ec82e7dc2af96c55bb2b79f789297dfd07c403f1d8b9b1a19c81066fcb9b0135cdd21f4521656af0100000000000000bb73ea7c2be031b6729e1cd6d207554f6a9c2772e7df4ca0fc20a821ed7d5df28ef005a4cccc71310c942dcad6f9dc35bcd5950c594f10f57c0745adfe2eb005e3462863f5eac5c0a2ea3d5583a22ef4acf4ff750e3dc66ee97eb264d29045eb3047138f5594c6b555d548858808d2644a6a200ff800"], &(0x7f0000001840)=ANY=[@ANYBLOB="04030400faff03032a04"]}, &(0x7f0000001a80)={0x1c, &(0x7f00000018c0)={0x40, 0x0, 0x63, "91089d5926234785c177730ff89ca584bed495ad362af00a7083c856c70e5b34f324550050de009a322deb28e4414b7e8586f954971d831aef74fcb222c3bbfecbe78769eb6aeb45d509c7bfbbed2ff530af108affabb07d740f72266fa0ac5d3d43bb"}, &(0x7f0000001940)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000001980)={0x0, 0x8, 0x1, 0x60}, &(0x7f00000019c0)={0xc0, 0xa1, 0x4, 0x8001}, &(0x7f0000001a00)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000001a40)={0xc0, 0xa2, 0x2f, "c6aa41385178ed746d3d2195eb3bb17b7afb517b728f344f52351bb1b23efb6267fe58d6ebb5b3787f123665b6e19f"}}) recvmsg(r3, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) syz_usb_control_io(r1, &(0x7f0000000540)={0x18, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000240)=ANY=[@ANYBLOB="400d02a7af86"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="00116987aeadaa4ffd000000261e8cfa3f6ec9edd2fc1476b6484366123af76b6cfa43384e256fcb79654744a894f11698e291040527eadb7c4ab5778069f377b68c430de5556830156de16d3f58613f4deac3681fdfb20d6ebc798af112406334c8125fa3284a2523259727df4d3b6447c3e02d1acaa21448b6404b7e081adab0e8dfdd142a6e7a82d3b9dbbf90f209f3f662856c5ad4853910e8b65e32348984fa9064641d583c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000000)="7e68d13024be0c4cb52b7ca1e88d4a1e75f2de75e44ffbdf5a6dc9b31c23b415015ae69d08a019a8ba129662761d97fe6822d32cfad6c2273aa13e00645f65ebb2837bde6efe96a85bc8e5d58ef9ee963d0a5b4517466fb031cd73a0dd330e39cc06f4d58767128e867d2d23bbf0be13e69bf48ec33d529ac830f7309e7e436981965441e7871ff4bd1cf9c3bd54d0137ac74f25e836ebeb45deaa239412bd76624d49ab9c0bce97487bd48abfe179389d8d532b86d0f3b32ccf6e27b8eeae5937eff2bd8e2557578d9ec1d21afa0c12fafe535210efe0d86cee64f057b3457116387069f2630ba985071eea103c63dbf63917", 0xf3}, {&(0x7f0000000100)="72c2a7ab8ce1ba55d1306aba6590030457defe4dbad7d5fe9bdabfc3b8833a843f96e6600d30547020765ee1c11dfb2ec5e30003d0763a4f7dab1c3d4e656894064ac344", 0x44}], 0x2, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000016462f87e00000000000100000a38000000037d3991d8236cc67312334236966c000073797a31000000000c800480080001400000000414000000191d373e829fc6e713e08cb90ed92cee5edacc44ec21bb974c7fe852d441fc6adb5601800180eb793669416ff5e093843416029c20620d992520d9ebeb2af84eb0e68fd31a5650f692d1c9fb515fedc8cba40a3f218f76b1cc6bbfffea5d394f879b0c00000000000000000080"], 0x60}}, 0x0) epoll_create1(0x0) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) socket(0x10, 0x803, 0x0) r0 = socket(0x1, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket(0x1d, 0x2, 0x6) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x24008004) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c0000005f67db2b005519ce54b9a500c91c7b14", @ANYRES32=r1, @ANYRESDEC=r0], 0x2c}}, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000100)=0x6) socket$netlink(0x10, 0x3, 0xf) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000040)={0x40000e3, 0x8, 0x200, "b19500000001000000fdc9a7020602371797e39703aef4cf8600", 0x3231564e}) r5 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x800) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000002c0)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e1f, 0x3, 'nq\x00', 0x5, 0x81, 0x17}, 0x2c) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @empty, 0x4e21, 0x4, 'wrr\x00', 0x13, 0x81, 0x6}, {@dev={0xac, 0x14, 0x14, 0x44}, 0x4e21, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) bind(r6, &(0x7f0000000140)=@ethernet={0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}}, 0x80) r7 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$apparmor_exec(r7, &(0x7f00000002c0)=ANY=[@ANYBLOB="737461636b203a0060d499100949c23262e80dfac1d62d08d42dceea7045b533260ba0d30b2345c44997fd10d56d0e2c427b3ca73ac20a6a4e0cf57dde73abc9d59b8049838b1c009c699a03ddd674e577650ab0284c95f7501f950601b8a322c74d9edf6bc06aea1ff1a4269529ffa5e90880f13074c542e5616eb82b3b860b5f187458e50cef0f4f10592107ade7949667507327592137c20b5e7774e51adc60ee516fd27c3cd984a0091bfd0a5a25fe43065e275e4b8c95139e8a0c2b8363c0fd7d7443d5cafebb5e4b00"/218], 0xe4) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$drirender128(0xffffff9c, &(0x7f0000000280), 0x4000, 0x0) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, &(0x7f0000000600)={{r8}, "43b341271b17b19581f75d6e423fef0635c26f8e50fa724a7c2c5db071705db1a767821b252136adad5a1278f32feff0b3dd7fb43abd2750db6cdd4b21bc00725230835f3a4fbb801f4170b81a451c4a2f8ece74ed031ebd2dcd4c2c162109d42fe023e4dafbb0a42fef1ff323bb74b8d5e0ce3990c3feb5ded670f7788f7b14d2eb9c3665ee62cd3e1c418069d5080af279cad05ad05e877cf587b93ffd466ffc283b79386601b3e075ec357473be3d3be95b15dc47e0625ee51a1e7c513db7c280f1d63c0f509019773667d672d7ead30766ea2b1fd604348d52b9d8b64694e11725ba2ec22bacfa8ecd983db081ce648b272550295cb3052c8909bc4d3936d5f3b7cec3994bbd76f8be86269befbe017fdab534b68d6d3db44f94e964331c469aba7971da3f4b277bcaa9a7e0b7fd9820dbd835c5f330bb1503a4f8b22f7d7a007207cfb9b61317c11093440a4428fa22bcea79586258c61888e70ae87cea15f01d5720c173004a5f4b92de1647b405e961ebf3b45756b97eea0ab45547c8edd7ae5d859079771e0de442151f800fafca652c985066507ff62ee73e6c3a1bf337f2af500249cbbf7fafcc5eae2df5064048becb85c6ce9fc542b42c4ab932acf98a905aea296a847a0bd2f398f847caa809ee94aa07c4b906206bdb8f07d78a5b5309fade89f74cadbb7fe00d12ce1970aa76e1f4d2aa977b93e3be701d65270fb8beff318c2d92fed0b615d163cc1b31d919a168d2ed9f5a5ac224b43e5fa3f24bcd084930363181758886f9250d3d7dbcc4fb9f71e295ed22efadab34ce4976444623079e89894c490dac964317ea2d3121c191116698c00f3709150087db3b49d7012aeee34f2387ca27faefb1ac857e6e52930bf02ca810bc023cc7ef1b8804870d2a6204b0ccf7de39a346faa66c8ce81bade155e3fb5905fe1591d33f322a9f7c53d18692efaf492c5bb76aa9c1abdfb26fbf77980cacc5ed68825dd5292422b97b2af5bebeb8666fa0028f137a321a53589f0840f47283626eadcb3266de6fddf67845e0fb878a40e49af951552badda586505edd366fb7c277d0ef655eae2dce2a7b22084b008577cad594e83249506df93eb12ac1c4c075288264c0c071628f1f9eb64d5c13134fc9f126609dc76ecdf4d65c4833a4d3fcd8d06256237eb86274b6b716385609f2e799959709c946f7fbba3b51355055ae6cd180ba2fcf5bb0c4e885f564735d3f8d40207b5f17e8e8f982b979eb7712f5a17354c67fef04891de336cf751b79db939600ff6603a4c015a1d1ab470ef906921c0fa18745ca2d1c1f816f38f9d10433e8cf5fb1da4f8deab979f1ad7b932a945cc5ac719cca126700ad6e49e8adb341c8846371517d710d2e374a8c96dbbb769f067c1d8b8abcdd0be16243787a2e27d5d96989376c04346f73c0fe2c5f77bff8d3044047cb0232325859ca0c5a9aa1c834e3e13b568a3b146786238dc5210af5953d9137e7f2f4a18651d7f0fe5ff9a53ce55fb9bc030b6b2f185419dc03cd4296dba13d65476d6991280031b5b519ba776cfd919df59d2e3e7054643d1bc93a1a8112f9cc6fcac4da185c96ad7beb2e849e4bb9d5d8df9eee2b9196bea115778f45283f9c7bfc5c9ac0c273e6b546854b2092bfa8fba7474218ee6fe63d28882d6543c8342eb8ae46964c11d86d3810cee2c3936edb43859b9252b98b310ca19c73fd31fcfe6c2fbbb27e5feb4215af251d9356c5fad169db2e6a1a1c6a32437114bbe22423a1582af6b87021101b20f5df3aaf3668c22b3ba6f2a359d34b5bd90c13710ca91cad8e6eb580f20aee5a94fdc24b7ec6f9bbc3131618d2e2c08f2ac7261cc3192996f0531c8a87d54a0c3d486f467d71f378a0cd7a0e17d93cbcdb9adc5d891387697ae791082815a35267e9968ed2eba7bc36d797b8043d85f92fc60b1b6fc860bf267970d9dc07f16e224cca6357c59e8befabdd2d0bd5fe4fef551fbe38f56785ec3a3ea4d688924be81d0c96fd81525894de75a660bf85a8db7eaf4b221da25e5d7a6ef852ddd6be1f373e9ac03fd8f3ff7bf6a1b0354ec8caeea21f5423c3c97b0005bfe918712d2cfb9be61ae6711599a73981459cc56a75950c97efd3ee08294049e3e5b0003342e72850b249d583036205b176c32c2ad28d14f4cc5278539a6490c3a78dbc0abb9ad652fef752869f2bea58ab8657a407169a9c5dd5c7a71a0d0bc3dc24ab54e2ac28a39dd03760d18ce9f845fe7450785ac3e9f34a7dd4daf445f43c3fbf062654d23851cd830b2a6913e07fd81e8666a8316181152df01600d3e252b605caed10f161959adcd8455a07460ae70d969bb384b2664c6714edc79cdb8d058b2b354f1ecbc1346096ae30441ab893cb3917995a61ee5afae37095003b6b8a7a0d15c9004d40bf4bd0ceb1eeac142c17e13f22210afa9b04b31c5c12941dab53d367169887e823c2a1f51c96c450fe9ff072452b386217330be66c1b10368c12009b0854a583872b301117a020210e383da886af6c7f6ae81c294f83de1ebed3fb0d962073d00fd813e5ed1e2bf4b43f588eb8ccd3415b170e490d8bc5aab1358cb19a7d50972f3f92c58417183e1e682c69ae9e5cc74f38626799fd1b08512f6a2fa2fa0a52c575a97bcd979fc7879b980239d5ded16e6b0169dffa05eb5e22b37428e3a0288ac0e1133c29b6d513353092132dc48acf21cd3b51e48f2b54e33adefaf9f22459c517e267d5a4b4b9b266c6019ca7ef589ddb7e3f486c205bf62312be182d5d861731cb184d1478e18399c320e46005b17e625a4f9bcab4058a4a3e099578c09916f45ef9891e7a1bfb433876c4d17d5fb9bedc33c17d4ce33a781d7eec28c9b46fd7da6c128bdfcc34ed7f4a5386c335e588aa8010030df7bc4764e7217f9c585ee7981fe134036d87aed9bfa574a793d95313eb9d073475e15c542a9ee7b9b270b0b5729ec152602bab21ce325d34853768e30f680cd83e41ab0381ff40969cc23bd46d4b73de348bf1f734a7c65ccb19001e1c914f2d73925722e88cc4d633f50a3d5438959c42f229ca1eb54175f021eaee2efff5db707817ecbab6cba4c230034a155a2a8d9fa55b85a2e4fd3ca22ea00c385c11e463cfd8bba849ee656253c834822fb8444ed25cdb541f99427b863d329f0aafca8ebc60bac4928a0ad289c3cc518596a1b19c160db2bbfbc537be04bbebc50613f537209247328615ddf667ff204e7a11181c520177d0ca83b4a7e07ceaa77e0659c94ab68f8794461f16b43a993c242f15d8fb7985e21c0aa10b6b43aab3feef6730eec562379da87a35de7fbaafee05c47653a18f5300fefcce672cc092c54d6460b6a37673c5e45fb55870833f991b007bfa31b2fe7ebb7eb8fb8b583b6a32b22f998817b877d634eefefd3c3895f35cdc210fffbbde2fed423e17b919d356c1dfb3c4476f5c70b592f76f05372e1443acd1b67b078e0add24979d4730528bacf9c50e7fbd37b2b24baa7da3c81399700bc21291871b5cd063bda83e981b1676f25685cef44824135ca9695c45dfb2ffcf4e73e8992d493c9fc525a0d0b0eb94fc7b1107a4e0459a5fa06c919079bfd65c0d223eef11dea3a964a7379c7ed6174b3f1029a53e50aaf662f8ca0f206f89f39c7baaff8d45c47160f3c653f029b96006f50f0eb2b521955a54ccc93e0adaba69559a43b4ed523912023137fcd1304c93c28da82cb55ed4a8d33f5c62817251eff1070d370bc9d86fe890864d80c757d0d153228ac70a66510b6c9c4ec7ba50f9492d9c600baf9802da8a336d0bd4b9205baed77590a0adf7a0a68a6c33727cf1820694a3d1a81e7606d7120f6c65eeb063b5cb9e2add190904d8cb1e87079ef0f9b6461a02cbb269b70ee2f5973bc72ebaaf565d5f41eaa111d0d4246e18a0cc654b007a3845fe4ac8595221502b17abf93aa44def893fe9da7fcb6e4080f0722df5f4e182743a5bd8c8a374ed7fbf17a57c2d4474227bedf6c6ffd0bdb86416832fc2e7a9e6d828f1f369c9af1beaae610e250a5fdf884dc2896cf5b1c5df6dc9b10ad3fa6326514629c2ed2341fb4ca088205982e3ca284250bb4904ed925e0ba3483bd15d4f41937abd52cc5acd187f789b4356227e12f914b4b56369c2c166b37f3d2bc275aa0bcf6b7ba60899166b70bb34ea418e07bd8a78393182286aafbeafd6725f17cac8336bc7d0a4391067f5cc78f386f09f0936602d1fd85020636224771cd3c894513042fdc0b6912708b22e1c5ee1baaf95ef94d652636cd71e667d864a918ff26a2bb42af63dcc6503d497712fdb3d6d400f876664fd0cde2700b8bf1b1410dd310ac2571b4a55fef1eb2da793de2ea7ffa0ec4cf4e941c1a92c977a24e7e0141c8ed20657b00ef9e58777e6faf680418547d31cc97e6a6e870a2b7e36ff94adeea33a589aae40e0656ea1506e4a0392e2d69382b38f5f2d8b9faa0f0d3c58616fdecf8160502ca277a0d1a8d6d7b0380b929b2cecbfe748b36f05e107d78371e94d14ee7ec360b7d06576245ec12cda76c4fd76466061eeb0af35a88713638048f58749798e15fae857db653556f7eb0a14a5fd4a32943a27753cd842dbf6e92f8f83e0f467a9217395ecfb818334d3f0ed7f0ab821afea44952239cbe6e49539c95ca0bb0b83b875f5ec0e36e8893098e497e7ad632f4e7ba88879294e413444521ee3cc53bd7093e29ed38c341d15a5fc29595eba3b5fa547f530735637e5b6d2967378cc07fc610f89e6cc0f98f1e4e0b3401ef87c7434e601a02cf931589ad7692347e11a53992b481af776e97f1dba017ae98b206ee66a4033d4a895ec5b865b70f262a70499a8d42e31792a4f385fbf7d39c476bfd23a888b8fbef0b23b655c4a48d75e5846e86955c08015560b4642c6b45e213a78eb3960978512630439a220b841bd1276d0f8b88c514ba5d1044e9c371bdc11ae3083bcc274989b65b7776248175b03b2b2b882fab0eeeffde444e75ab7391fe4e2d318ce073d30936c59251341481b6b0fca1c8b49fea22fa2028e22d366336725dc6e6d4ea3517404bc789be683974448117bf029ed4a7aa48f2ecc2c7420d2c859bbb744c86e55f8f9ea0fffd13401d35444123e05cdd54bb8e8e6d5932662ee95c4785c01f32d991ba97deb5d8058dc67217b6a568158224dde2054bf315441da533f18441a89d0012cc53f8a224a0401d401f340958d37d3506a4434502121130906118d46de0a56072d48ce5c474a2183721ff0760a1e8225b8a335e55272569055552df3f9359edd64f53e96991a3ba7aa9b17f54997bc65b0177f38a220d005f4d4b2ab849085aeec63ce53c28fd96a8482bca42e00e454123f501e62b893b05a8e32c83d02c2c3aacb7f09755b1731e9ead1a40590d2af85753ff8ca90a8512feeca4797a6fb8c1c38de5e8b328b01b56539ad762a0206bb2010ab0c71105457f7030cd9fe957386754de7b6cfb3db3eec18c95bd503a20bbfda25d9341d103b06d33f9721ec63f46a9e192c5eecdcad018caae7c580c90cad39d928d145807fccaeaae367160a21edc55323f32566974c3dfa16a3396fd6f08f3f6a4f44852a49e8f77813bb4c1c6230956fbb17ef18af137237914a74ffa9cd034248fa5e8cb3689b5d7331da06d2f6df009a9d5e173ed43bbe0ab07858856414f0d94e10404087738ba518bec8571c18d1864f017f1f23eafb341dcf736313a09e5b0b69298534f8198a4b2d3b7097a6f6dc0e64406fd43e0"}) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @remote, 0x6400}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x10, 0x1, 0x24, 0x3}}], 0x10}, 0x40004) setpriority(0x1, 0x0, 0x3) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x5, 0x36, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000380)='mounts\x00') r6 = epoll_create(0x10000) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000040)={0x9000000d}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8001, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$TCXONC(r3, 0x540a, 0x2) ioctl$TIOCSPTLCK(r3, 0x40045431, &(0x7f0000000000)) r9 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x3) r10 = epoll_create(0x4) ioctl$int_out(r0, 0x4, &(0x7f0000000200)) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000040)={0x80000002}) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000280)={0x2, 0x7f, 0x1fe, 0x1, 0x1}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000001a0)={'wlan1\x00', @ifru_flags}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r11 = userfaultfd(0x801) ioctl$UFFDIO_API(r11, 0xc018aa3f, &(0x7f0000000940)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r11, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x54815}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="91107cfe0000000095"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) executing program 32: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="91107cfe0000000095"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000000c0)=""/175, 0xaf}, {&(0x7f0000000940)=""/175, 0xaf}, {&(0x7f0000002f40)=""/4072, 0xfe8}, {&(0x7f0000000180)=""/120, 0x84}, {&(0x7f0000000640)=""/119, 0x77}], 0x5}, 0x401}], 0x400000000000062, 0x10080, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0x9, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket(0x10, 0x803, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000001580)=[{0x0}], 0x1}, 0xa}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000016c0)=""/18, 0x12}], 0x1}, 0xfffffffb}], 0x2, 0x0, 0x0) close(0x4) write$tun(0xffffffffffffffff, 0x0, 0x110a) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x8000}) socketpair(0x1, 0x100000005, 0x0, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) executing program 1: r0 = openat$panthor(0xffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000008c0)={&(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x5, 0xa, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000900)={&(0x7f0000000400)=[0x0], &(0x7f0000000500), &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x7, 0x1, 0x0, r2}) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x26, &(0x7f0000000100)={@broadcast, @local, @empty}, &(0x7f0000000240)=0xc) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$XFS_IOC_ERROR_CLEARALL(r3, 0x40085875) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x250, 0x0, 0x8000000}]}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000980)={0x0, 0x0, r1, 0x0, 0x0, 0x9, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETGAMMA(r6, 0xc02064a4, &(0x7f0000000a80)={r7, 0x3, &(0x7f00000009c0)=[0x200, 0x7, 0x5], &(0x7f0000000a00)=[0x8, 0x4, 0x100, 0xfffa, 0x8, 0x8001, 0x2, 0x336, 0x5, 0xd], &(0x7f0000000a40)=[0xd, 0x2, 0x7, 0x8000, 0xfffa, 0x200, 0x0]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) socket(0x2, 0x80805, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) epoll_create1(0x80000) syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r9, 0x84, 0x7a, &(0x7f0000000340)={r10, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) socket(0x1e, 0x4, 0x0) socket$pppoe(0x18, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socket$kcm(0x2, 0x200000000000001, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r11, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, &(0x7f0000000280)={0x7ffffffe, r8, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) executing program 1: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x1}]}) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket(0x10, 0x803, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x65, 0x0, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000380), r3, 0x0, 0x1, 0x4}}, 0x20) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000080), 0x56}, {&(0x7f0000000100)="08000000200137f73199aee6fdb9291b3091ec1a2d41d227975ad8ec030f5919f397867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b374d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x127}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000024c0)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r4, &(0x7f0000002300)={0x50, 0xfffffffffffffff5, r5, {0x7, 0x9, 0x40, 0x31008003, 0xfffe, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8}}, 0x50) read$FUSE(r4, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r4, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r6}, 0x10) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x3, &(0x7f0000000140)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x7, 0x20000000080, 0x0, 0x4, 0x4, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400, 0xffffffffffffffff, 0x6, 0x4, 0xf, 0x4000000007d5}, 0x0, 0x0) symlink(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file1\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x1ff, 0x80000001, 0x9}) syz_emit_ethernet(0x36, &(0x7f0000000180)={@multicast, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x11, 0xe0, 0x0, 0x0, 0x0, 0x810001}}}}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(0xffffffffffffffff, &(0x7f0000000080)=0x5, 0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ac0)={0x14, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}}, 0x4) socket$igmp6(0xa, 0x3, 0x2) executing program 1: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000003840)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20006, 0xa68d7c5193c827fc, 0xffbc, 0x6, 0x1d46, 0x32, 0x0, 0x0, 0x4, 0x9}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008380)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x68cc, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) writev(r2, &(0x7f0000001500)=[{&(0x7f00000021c0)="bcc8c769e82398cc3fbe2fdd4fd560b95a3e555b631762bb6ac091b62a6da6e21ec0d106f5ab97c45380c2239e7c5e17fea62403e92e01c027f6d6493c9aebb239d09645fb45c2bb45d12216fbaa8e5f7ca69a41b0a891dd76938f3819f76202d62308cdc9270754011efd5a6f1ed262af0c1e1af668a5b7e6fc56da146e86ee7903ab765a2111269638e08ea1b821472d98a084290d163afa019f0624bedc915b2a807a5724f2837aa46312e69c24dea29ea9b33d3e3f81d2edf38640229db9e190b1c839790afb4d06d533cf45884533e82b85d3636ee2a386cf43baccf15e6352f3548ba2fd03950ced36636584c7d730d10f95ab8ef67648f5e10af9b67ea0585ee561537bfc91bdb0b4ed9a6f140cfc443e449057b528973618649994c7859dacc38645c0d070d378be5937d1113f8f419a747061b0b4a4a89fa55ee05575bcbde34bc0b46366004dc6fefda3001b063e17565d790c5b9bf1a56b62e8b92124fefacddb9531f0a0ccf2ed6e4e2e81e1adeee0a6d9c00ed9d0ad39f4f939b1aaf1ff1ab518f26384e8b45006821bde5f2efbbaf521b77c8cf9619af8158e9d6ec76ef9d257bd88111f38bb09ccb611edf1c49a54f56d60c0f9997db0b64cd4465f4ece177ab2cf7e15933d6fcc08ad2580674709632ad83560114bb8d058172e66daa67141e2df7c79f68b6147af70e60405fd88523304aae0b2bd4913e66d2c25a64c3983db474c21b2c7c9caec7de72aa2c9ebadb649212c53fde7719b21ce83e5e54944ee6d472a3d0412848c449f1fedcee06258067408ae7402804251b0e2929c64c78bcf84fa964cf23b4354673cd7086b70bed7cefa3be3d5345fc8e370273bef29b8cb8b78417bcc1c43f7777f62113096fff28256f65f93516cee53e8a29a776b2c40d1fd6e29970bf7e0d5addb2d1c7640e93acd254f3bb9bbeb75a52a407cb066899ea3f50b2858923538b077168ab0ce51184a392f1d0ba3da1abbbaeca1a9f68b5d1b68b850126559f26055b774cf60ae25592902c45d450b599cda895830f962b9c302c96cfffef0b7b390e8bcab3be47f829db567f3a3daf1615c29ef0cccd767bcc74ee228b68416df63e48cba55c93bd262d46583ac7d2fb0641bd4e6fa881e54fc98862da5834c535748542be8743c8ae40af571e7df37f3aa90cbe3f864f4aa6c13f9c9577322bf773d2a5a3dd4c565058f0370db9bb24c9d2b8368017b8883e7d552e9415c0d21b5b792a5525001a3ddda0f93a1e1a33b06a7d20007d36a40af2e30a590fb30ee5c13fb281fd1e870a3cd0aed81b39db9f99be17fdc403600cb22f33cd5c22a8dfc87b9890b027a440f58f4e279b633327e52abbca16e1d0a37a77e4b8c8587089b61c662b7d05b0b545db189c4104bf17b0bd06633e597daaa3084df3ca53a5456cfaa10ad865c1b5efadefb9d6cb726ac633f7a344c03b73ea6821e0590cbb6fcb01e5c6c8dd0013977052ffcfde365ae7a5f3e8ad4dfcf10d1a16d30d1fd96f76e7effbf2fe930a0b468de44d3ea27f9c88a360b65ee33164651a5e2cee43cf133e2fee8a245a668b627df368499c90cb1c006a28af6782dce59f0edc3c6541689d805b123a7db81cf47ed0b0fe0f207fefb8012997b3fa8ef5f9cd841009109e60a2b067cdc18b5b2ae73f740ddc28ac0db87f8a3cc7ebd95084d41e8ef74c1650b9f57ab3b72e3a1565305b83251c8ebb17254967bbcbfdb7438d9f0369544aee9abae23c4146acbf9ea3ae06d2aa213ccf3a289ceca35ec69a9699abe261f9781104f6db3bc29e6ea3fcbb14a6494d27f11994c2a522687527031d61d2f3d37130dcb4c973de75cb225f81f4b86a29e5a15e8caa939b9898a6b88ef5d391d224abfedb02e08d1d42ee679896ed720509e786279f3ebf90db467cffc877b0fb674c51b8ae88be97d39f480d42f4066e03faed5505f0cf54bdede644d64fcae986b16d0dd5d584c9251066d1c732b6feb70d38dd078a37407fcec715862383b5b29e4f54f245f499d60477b0f35aa21d4ca028ffb27482cae7b06e61a005500b41b195bbd09d10ec106e4e9f4348da044cd0d1bdf2e2247368b98b012dae7085b9103c3563a5897cf6f16197d2b3c3d16aef17f196474429b7089e66bceca3e9d3becc58be771983fd9ea5c0753b7c100165e51866e7edf1d22bf02f53e47eb4e5b8b13149039aa1b69cb2765089b82e9f3b47ce857cee565a83faa8027e7e7690012e644d5fd966a134f7bd4e1d844ed897da5848ad83955b46a8cb4ddc4a7ca604cffbf9451e5d80851d3872233de4f30a8121f4226326b9c3f854b8a2cf1853dab3ca6519884fa7adbdb47b212770dd6f6eaafac6d29ed0082d86ab36a99eeea2f0376001858dde640c05c805c00c5913549e3833aa69b4342155f4c26de03d2b2a5d5a190ff548db18b7fe30c06c0bbbda35235379f68b1f4a8b0484b17784a7f30c2bbaff28f2396a79104e1e604dca39d3e96e247f66b4758190f35234741b56d5b321926f10e67cac42d588b19253490910ab607a08c1bd34c7c141dcca06d098cf8522036702778354706329dc0b0228ed050141f5343bc5dfb4d496b95a2d841fcc199de4fe31f18abcafab45ca39bb40e0aea00137de939fa0070c6fdd9eb5841b4be2395801bd618729627dcfa982911bbd937493a28f1b6606af25dfcf5a95c2983e490955ed1d22dca4b9a2576e5df0a220e6503ca3881cf35c1cdc3a618b87e4258d47a0b4642d3ba38664da9f662fa250c44b53d47d78f13758badc0316f6cb8e08fc31645a0b2071db2a80204e197dbde32f2ffef7b92a572d78b9b00aa82c9f16e1f101bdbb836874cd84fa8662fb7ee7b95ef0ac93f3d10e8d1f3c19ee080a83de6578dc43009ed4ad1b095a45ec7a2f8f482ca1a2d0da63281f29a6218770e85760f07da1c59ebdabb4d37af4088acce2139531c5061c4a183075de6681f84366cc0e89a3863f85c14bb3cb63f5c0967364eede3ea6736a0212e9426a649c3ea70843df1bb0186244e605ad721d2e0e39776591d04c0f2b2ef0e2862bcd64203719f308c38495ea7d9e44d78418e2b233b1685b8b996ca5d806a4be27674365de1d7ac11c5bcbe3f724831f0f1d3f7c2602ee90ae99e1b84650c3d4847d32e5d183c5f7ab6df431d9dcc0258a2d7541f150fa171923744c9ee4e539d659256b90d3ab101f29f7b69c13a486ed470ca734689c48574a621b74f4f50c1be0c9d2f3cf26f66ca05cf4532b576fc447bc3eb5246a3b4a234dca0f0a75225a3b35554837365d720eec864d6d328d1028029022d265853f195a36a0b7e08e7a1cfac4276b23e3503543d673ec29d3f2d5e8acc8e86d01dbd80a5adca6fee55dc306b7131fa7b456e038d6b30b2384b2d47d6dfbdbd01520f88a2f42ddb58acf75742085cccbd6050a181a2d57ddf7977dc2a85bfce9a7dd6a4de007f1be10e111fde0e4354c14fb36df36df9347855cd7688b3471bd1ad818bba982bca89e6af156977de37465ba1107b151c8e1ef9227f1d688509f3bfe5a83c3f1347282bdb8767e97de6e1ce3bddd26a3fd32d5ec074f75a8446bb8137b46c3f0fdaf2c6b12c45447f8dcc9840ac0c6e6046b14be6ca50526c83caff793f907c066324e2b4250b870298e756bbbfe685a3f488e90181e5475372eff77c93c55400d77eab9bf3ee48134901108979e17bbab307399e904b4132807b7e72133d0f5a00607dc0d69c71231c4a0027abca775e60144d1d7f295ff3fc14a95315360e5dcb1550c33bcd4deec5971dabfa635e41658a9935a3266442b0e90dc2144204a933644799fc129646a869d2e1cf01f3bcbbd1206b1b87145c3037abb7ea0e149c8e5a1f9f9060f838840d8daf08b009f885a2aab890f801ee37554a1c93c36a2445f1dacf64828e07b6962b09434f162460bf6ab906aba3ff039f9b65063b52d48ab6a4d3f6d2d9313058813ef5f3df8841cae49aa9eea6736897b6375c31727b9e8ff81f1528688fccfe80debd5d2d4808bbc7b909442196a309798eff88d4d3f792ee7c583bf2820474e297f8fc878e4845521c656735d2d7cf76b6aa3031ca0b75a3443bbf8733a1e7458341586fc4d1fda4f984c1efb8c7d1ed34044cbb1eb185b80073d3acd359d335981c7a0ce1869c17d1ec3efb74461889b34f656edc4a4c2b69e1e69c1680e5ec62007c81c6477392a624c8a11d16c62652877dcb62aa11ae51d68cb80fd876a6af44553fc7d4d9886775701eb53ad61c1651fcdde451319a02fb9855cdab98a6ec9d3599e804be69b7faea425ca1346dd0e744cf31066fd0899714eef7c1535309587434874ce0831a5baa19f403ddd90cf88d1eaa12277af90420cdddbac438c6b2724e019997b1783c7dae72828ce4291afd70757134974e21f3c208787245576069c7a80155526374b2bf393d86ab9604380c61810ff77e61aae6c29e700f23c31990777c575b6d958d2c0afea0618413be5fd2e9b3b2c9050bc3879f1d8cac1b89efb0a79b8739e5bb261ec3514fc95d707be35f31380bc03551447556a20294cb1f22c182eabcb423191c91fe58ff9f0fd78227c533684295ebbe6717edd21dffdb2b77f72f2d7a3680b42381c9bce553b30add259dc435c35ee44d57821779af3e436eea673e285fda05b7b95bbb2fa2dfcc4c4c5865c99031ebc574163cd1da018b0227dbec10ac711e2e6d0a3d176d10c2e26c7f147b54e39e02918ce2bd0185a34cbddf0af2050f053305e0cc8a1c9693f3746716fbca856408ae9527793122d135dbee9df9c4f3c5a714d74b92b23d525ea52848354de3ef91bec4a189e3c04d2b66aaa06d071d4f5a54a76c5436942f0775767096fe1cf8097e7e1fe24106678eb06dbb0e26a2669019ab8c35f05ce6429517df75d83d2b93a5e847c6e4ffc429b24d9d73f5072913ec0d4d33c6962b9764c7257c3b57ba03d7829a580ed4a87fccbeb729314eb28f544cf11ed81e8cb12ff8a200270ada885919e537f13439a7f5f68a023137a5fdd70bd17ce78c898f9a534824c4755beba41b5b38b069263fdef27c2d6bad48b1ecc79eb99c3dab9cb079b179c9bb4994d51d4f935735e59c6ad4f5849a0a1d741fa7dedf9be6d6d5e6bfdaa248d3ba9dd9f17e0223059b525c2b61013e272799767e7d6c48622840056486b2e7bcb518fb1d30c0c73a8a32e1bf83f34f42e7cd6bcbbd2ea88dd274a660aec13ae5d814931b59dea3372dc6b8edb2ee44709f85eda7991c52b6779c25ff8faed02e1bd9d6700cf6fd985e3c94f98b9134117ab23f3bec80d24681d32031af4859b8a6992310d166c43d1282f2d25cb3a846555b655c9558b7e1be5c3196c3c2ecb9eed01c01677b0e88c5273969dd5e2745cd2cd7237756b2d4946bdf00b7bf5375adfca0daa09d9c094d0c7a56076b3de1065a43a3bb6b0f3290eb724735121829155f9ebfe59d94c8b5a3ccdef3e8f97edfcb5e9102a24761120b3a2e0ab8e27e5775f736208d1ede54c13c25e8397d4d8a74f8942020e1f052e7aac1f5f23329ec9bafb24f586dd3654f1bf275322306eb222339359ed18a1cf7b2f63ad8d6ed44785a4d88bfb44cda8f54b052b3d03f18ddf45fa67675362ba22ecfe87c73a9794d1a1521ca3e23eb538ac3f853a295d62fb12202bf3450f70364dd2ed87524a33977e0c5d0402072e77ec09eb666a912fb40906407faf34587f863695bd0a14fd3d9843ed75e1f706fc9eca4ea655349077ca83758d8a2972c3b938b9da4ab06db07", 0x1001}], 0x1) (async) close(r0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0x40000) ioctl$SNDRV_PCM_IOCTL_REWIND(r4, 0xc0844123, &(0x7f0000000000)=0x2) (async) lsm_set_self_attr(0x66, &(0x7f0000006380)={0x54, 0x8, 0x1020, 0x1000, "9e269d3c3086180387f957da110ea5164218d3bb9b9a34fb63accb691c9c909896ecdc7f4982ff4b9ce52cb3f467eb5a94f3c84ad5b6bc9875a9efc027740c263246d8c35523ab4ad1e9fa896513bef905bec1675f04f964f88e3b9f1bcba55c020351fee203e60d22779585a441814a908f7488bf4cfb4c193280110c0343c762572949a29cf9da914070eca4cf922c0c46ff1a650e5c65d84254ea4288516c2e973fcb2d4d075465549693972c98b94fccfd54760c93b9bd75abdcd32acef89e2a572c4c6668387f138231bf9fc1e6bd3ea162e98900974f5b184cb54a28aa2f12e8dbc700c309c365df3ba04e1ab649433bf3b7ad253dc1c36eb763d3e2c975c80a82a1d6292402e02d31efd0221e44a28069b38c8ea8d1953ee8f721ab67eace96589a739e1efcdece6f85db97c775b3e5a63ae5a1df8d8898cf2b44fc377155343c0373b70ddcbab362e67bf2de19ebe626c7fdd7f9f8e40caa1f9edeaef1d4a45e48990e9e92475c040eec718c84815bdf3a2c66e3e6e07dfbf91841ea7416d90a1190a0489d7296d5c40b95139f5775c780d8e9cc6e3712499a7523c482eea92fdc6cf78ce68ace4b967ab855843789e05d74f4554ea712a90074ff3cbf2c63332d54d7d1729bc8c392946ae706b5f1336d944bee4141fe7854724e4b1023928c75c35ab5ad267c82bd32435ba321161d535d0137991feda8a90b765e513d6eb90a5f03cc490a20c89a57b4cfa8bc0d6a3da921bc8a6a6d3410238f6d7e309b4addbfbf920195010dfe8270193f259fe1317c92d9e3e2d36a309db27a6b3bc4566dad8d5de679b30556bc107bc4b4e09f0db909cbb79e0310028b769005b72716ace0015ff34fbf1eb9c4b520c6c58f40f87d94714b5eb178a09f8408796101a462397702c812947163e573d5de3d60afc1ce2915f18c32bd4ad032c75a781acaeb2c22bbb668c0775c586f288343550834d6d0ef1b222aea173cd7ba58d5366be4438117cce42db7eb82be8fcc34b5238029a0f003f2acd4c6d65bcd3f2fff93d0666edc2eb12da347e69f5b920f3df79bd22932f70111be0a0e9e72f3e2ed446a5ab2678b30b384d441c4c52a4f92e4c69e18c142f5e7f3f3684f52f9ffe859d0a6e1a0d00d9c2dd3d20a4cab1f9285d3de570eed1ae2b758272d9f2c270067e1f586553fc31d73b84a53fbbea72e7b0492ea4e21543017d939868544ce37827637dd0cace5d0f3e124aaba338520daa33a88d3f43138b640652c9fef5c1d2ab4979b915019ce36543866fabb5f073b8a0319058b61e2bfb65f1ce52b137a642279db06d0a5ee19393caf4bb2409ee2c8c3261a9fc313df153b0661fc27a19ea143746337772638d689c95b3cb4b570984a2767f749e026cf2c6c33a6a53fc6b320723d6299c871e05beafb24b5f7806bb933dc1440fac8186aaa21493b3f1a64925f0fbcc64da839c26322aa7cc34bb85faf010f9dd9b4f8d47e84f18d82c0389d6f8b5c0ab87a885d4f5508ea3356ee1c9422e1ce85f0a0221d1b703eac08492e9405356a9d9fe99b82d0c1434453c4e32c1f752c6bc67e2fa8a4392c6139db085e3459411dca6e8d092e415139752b98f368761919e016709228eaced0fe9a63cc8a68f63f3739b17f6bc48e3e4fa646707e732383fed406b2d2357fb574e81860ff7e3f66397bc6dae0990cb3871e2c4492a4d3b6f0a4afccb402d9574ac2ca22196a5ee1cda4ca5bcd268c689a1b36b5bfc1e8f0c7d85b9143bd3d5917aa104def7a8bbb430c43024b7007550094dd3664c995571241122344733f80e3ac8e75ea45d5b7572088932d659e4474f035827a32e7b065e5107dbcf8e0e8a78f39767be53c55c536b7644ab9a6b002e9d98d727e09de7e50e42b8e85077d03bd5cf8c2d40f71cdd6407db02aae3547da72608c074729a8ae880e75b3af87afad774ab84f28b0400843f4d3f3cb1127d8f4c9a12940351032bee0022e2aab091b0c38c3761247edb221bd3d477d54a4ddf272baa54aad975e6750ab92c5f520442d9cb04291973c492701707a64fbba06d3678253af563f73024b1eafd18e29befc38f17774c697144e6aff3a23b4fb854b9d174ba3152132d06a4a2a44b71c32b7c705d8901f44ff3f554ca2c479e31ac315d8515c4b71a228282d5eea6b787970e30609b7ae904ff05ed685112249a6d2a814ad59b5cd9227e99055073de6b86498b9f2592087eeae6cb971ad5080f2b6a16ec5c56324f1a3ea0af0f86d64225b17f00c467abfda3adf4f437d87e9bdf0390d02cfd78a388162c7ec6ac89ada3a811c5354ef626a11abb8f276fb3f0e5d78595629dca91587c8e661768b4ac5477f26abe2bbbd6e8213e8ed61809925af2f1a92fb02e70fd03d2d7cf4859dd271f7a82543ea9733e13812eed618ba04714c11dcad57156bf1cc3a9ddb9ed6c26508c0c37079c5cd7c308c70e846bac1b264ae0b9155dd07a67755ce0b214e5e52d6060d8ada4ed2b13b2fd968935e62a3363b295c8ff34bb2118bcc583862fc7bc29418b896c7387d08c139117289a4be0387d9bfa852401ba561afdc5ce513c8ec13738e265998eef5101dbda2591d6d235aa2e220f8e37ff229f6cac5fb903fa61bf980086f68f3ee5b1145f8024158bfe0856459bcd1fd7f538ec460337732da7ee2ba26f813cbafc76630dfb8cf5cb4b40303b9d473e8cea499da1e8a7984d85d96abee136079d1818d1278752352bafd308a600ba1991099ef6b653df61e72042a04c8d8288d8168dbb13b600f32fefeef4eeb98204157ebc27586c6314f2a9c3a8cee60595fc5bf05ae0376ca8c073101f881ac83ad7e5fb61bf161c7fa75dac0527e08ffc5e4bfd222affe40d10d7c51bb2239b6235ccef4ce89d88bff5378ccc098d81b4c228cf0c7123f3563fd15436ef809c9849cb792c83b3185dcaf7bfc9f56bca1aa1be08564d7e230b1df37b689af582902391f54d4d9d411e473fbebc227203739cb94ee70addfbea618f77845f2ab9790214c467dbd7173245fc99833f5a8ad30d30465b00d0706204787d79787b920fc5c04cfa317971c6716a70d238ba783e0a13f52e95b10401af29d23f9d0e0b64b84c279fa769bd03a43c643ab493b4680e854167654222e2f2c74d3018e005a8a546dd2a44b169a914f5153deb056aaccfa4962beb59423aaa980c5163603e72146263691f8c8bd49b2b214bcb6ef2e96956bc137b51711f71407d6c23a8ed93cf360b358bf8270387932bf3c52551aee364ba50c898d4ad8102f2624d604c9e787bf678e9ed5a53e24c086bd34c585fa110c9fd882fce3ea8aba0c517d5e631800e9eba6b2363407b8edc290d8820a65311287e8323c7747209c577ab673d249c497ec27d2aa5a803b30af0f0c2b29a0515b5eb906622f76ac3989418535c4539283e1c19521cff234ba16fef11fa8150c79c272fd34043fc2b9892d1c6e27750a980917e5ec50e736ec1e2b6838d4a4a6960871fdb8f4901bc82b9d671b38c6d3771877aacc5509ad0e2efafaa1cc0952ba9eb15c1b724f4553540cb3243e7970932480482e19fb083f2bb429967db9a2d338af061c1b7847e33d74c857893f3084d62674ab3583fb3f0b9e9b631b5aa4cf12efb8ceb56e366880aad4739771daf9c12bd2bbdc74744abc148430648fa78d6e6a056861ac7026b90769b7720459c728913a49f759c44b0d8b5a7c2447d8d20c9ba5f307418309a8e4ca8ea5673325e110c0be3bcbc0ec5df052d1bff5d5b55fff67080d57967f9fa718d6afc657e42399eb8b3edef2a9d8e0fd27e0df3317e7b9a4c6d2af2aea43c6561b21e134614d9c460e19783bad7bb14e53a8f20af808b7f6a39368deaf3211d700c8f5f0ed13c6e370dd535ab4fb2045154c0cca3928267eb0ec9c9185a6b6b41a9e280e225eb549788389f65277e0b43604dfb9c27d809189490c992b39fb94e0e1017c1ccdae4ad7565e3f8b8e87af0ed8729346fb2b49a2da61f7cf409a9ff6ed70c777735e05536004bf894731007f3f91bb3cb776c0f66585f43a61f2186c52aab5dd1e6632c2b2145f84e36ff7984e08701affdda84b400c609b0d471933b817a88b2acb1d162b80744345fb3ae47cdcb2d9326a9e0b964bfae61034f41cb847b43c43fdd40c4632181c3cd36d9ed0c0d2f7bda696ce76c999fffb553e6040e0c91fbe9aefd8ce8b9ded7b1c48618153f3bc4980d8be563a1593273224209c6c8af71fdb615023ce988ebe3e3c01a01a514fa6192812e7898ce3f581560968df8facfabd474ea32057a78398d55c30aba2d0945bea4eb845428080934fdbac0e78c3d9626ce17080f8b857a23468848897848ecb673f6872266a28f6a2e8d5ace9acbea5f79eab877026ca3b3c6cff402b6528cf7978a2a5581496fa553ef8af24dfbcffa5d9f16dc420ee8b899526f57ded8c25824d3bfaf79df9abc680d77e8d47407388dece3c4b6c39a9aa358d5ce7ba7be39ad28461e9f4ee1a6ed15656d5730405267a7f0a96b7fb956458ab60d522a7496635b9b659d224a68ae0a32a88fb88f7f08d283a14a68a55d263a818b3d5ba648df71a529545d245aaeec8b479d4cd0a3f1489162672847903e4157222eaf686e46fa8ba4e3836d715ebc7f8fe75e891a567f1da3365c3f3a937e99cf677659f8419fdcd0b9b6ddab3f73d640cf06cdb6a04c6f4f3be31cee7f7ceb607807bcf0500494f2f2ac92ea2fc5e7576aa4b713c4493c226228b6d0ceff59fe511d23c56e43b3c0c17dc7e55db950d62891b7248fc0199f8cff54b31591eb171a15f4d89efe58b99fd1b836b6b96a2114b9cd7fcd9ab7a858624a8ba9ff26bc588738a16633fc60b8c07d99f98a555d35a188036fad744eb3025ee99ae6311938ceac4fb8cff7444f7aa1302b602603df389da0c194a193b3c421b3fd9e8134487d93143309989d622eea3888a7b50a4dda1d87ab8778e95da410c2a27cb7b8dab3f6b15d56084fd37a77895bc2bcaae66e8cb932aa2c1d68a0ca475e6ac9af0bc1b7e601b308ad92ebb0254e917b2bbb511557752a49abb87b7b63b344a31215670459ac03edb871bf156ef836459ad265cdd2029cee2deee69062f4316afc41cc3738323ce1fa61ca4e17774ce854bdfcf198af90593e490afb2db858637def7e506c00142441978634427dd6896754b04cc2efa6fde44f0a050ebeff32d279f160316644bd2e4ad7dc7918f4bdc18832e6b29c2ebb0edd5c744459fd9d0bbfc2a92f8d9a02f59822b7a2d925d87f14f8c8f9eedfac494328333a929ab804eca190b27471341b734e8099c1657765b85fb620f126de4f50fcc99d816e6620b1fc03babff1a608383f5b0de807da0ee92b066e695dff63bf9cd0cd1411d01ed56af4e014de1fb93fb3197841910349579b40b0c8956453163838d65fc02ca8776199f4c92a439e08dcc62a503e9c406ef60af5923d7654e0b94f53a05f68644a4ad404cc9e31c1a15c57ff1f73c1524adae69db74fe0185690f4d186010c5fcb17e533388c7112f526a62aa18ea93274ad24f0b86f535034b474a3bf6946f17f01a09cc78499e090e1f424c496469d873105248a92772f46f1b89b6862f30eeeac0844f64fff7c7ca541d1fdaad3c5ad66e738ffa7298ff4ece5cd44c44cf29509d157e847993c2b0b5ee9e3fccbdcbeaa215e5d3c198c8dbdda3a88f821dfece1011c54fd87870fde96c327e6bbabc24a0f73683440591a8728f5e4191102dd957acf2e60924eee50dd0c3d3a15bf576"}, 0x1020, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) close(r6) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) (async) syz_clone3(&(0x7f0000000900)={0x23a08000, 0x0, 0x0, 0x0, {0xc}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="8c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00420040000000060000000c003900ff04000000000000d8fd010006000000090000000600050088a8000008000a00", @ANYRES32=r3, @ANYBLOB="08000500", @ANYRES8=r3], 0x8c}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) executing program 1: openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x4, 0x3, 0x1000, 0x2000, &(0x7f0000001000/0x2000)=nil}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000002000)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000002000)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1001}]}) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000140)={&(0x7f0000000040)=[{0x4, 0x1, 0x0, 0x0}, {0x204, 0xfa11, 0x3e, 0x0}], 0x2}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0xfffffffffffffce6}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_GROUP={0x8, 0x1b, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) executing program 33: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000140)={&(0x7f0000000040)=[{0x4, 0x1, 0x0, 0x0}, {0x204, 0xfa11, 0x3e, 0x0}], 0x2}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0xfffffffffffffce6}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_GROUP={0x8, 0x1b, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040120a105d0001000000010902270001010080320904000003ff0000000705810308000a0705020240000007058602400000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x8) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000080)='4', 0x1) executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff0000408c1059010100010203010902200001010080fa0904000002ff0000000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000200)="63616e300000000000000000000000000100"/38) executing program 6: mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./pvfs2_240\x00', 0x81b6, 0xf000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pvfs2_240\x00', 0x0, 0x0) pread64(r0, &(0x7f0000000400)=""/24, 0x18, 0x0) executing program 3: syz_usb_connect(0x0, 0x35, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000040ffffffff0001010200010902200001010080320904000002000000000905010240000009058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 5: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040402000750001010203010902270001010080fa0904000003ff000000070501020002000705810200020007058402000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)='\x00'/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x0, 0x2) read(r1, &(0x7f0000000300)=""/4096, 0x1000) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000400)=0x1) r2 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) read(r2, &(0x7f0000000300)=""/4096, 0x1000) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000400)=0x1) r3 = syz_open_dev$dvb_dvr(&(0x7f0000000500), 0x0, 0x800) read(r3, &(0x7f0000000300)=""/4096, 0x1000) r4 = syz_open_dev$dvb_demux(&(0x7f0000000600), 0x0, 0x2) ioctl$DVB_DEMUX_DMX_START(r4, 0x6f29) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)) nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0) executing program 6: unshare(0x20000) umount2(&(0x7f0000000000)='./cgroup.cpu\x00', 0x2) executing program 6: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) accept4(r1, 0x0, 0x0, 0x800) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) executing program 6: r0 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d61244040001000000010902270001010080320904000003ff000000070581034000010705020240000007058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000200)=""/64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="60000000100005000100000000000000000000000000000001000000010000000900030063616e3000000000340012000800010063616e00280002002400010090d00300"/96], 0x60}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000200)=""/64) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)="010000000e0100"/16) executing program 3: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xc002, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0xdb, "", [{{0x9, 0x4, 0x0, 0x6, 0xff, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xd8b, 0x7, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x9}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x80, &(0x7f0000000100)='\x00'/128) nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0) syz_open_dev$hidraw(&(0x7f0000000300), 0x0, 0x2) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) executing program 0: openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000400), 0xc, 0x2) socket$nl_route(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8102, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x80, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x20, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r7, 0x84, 0x72, &(0x7f00000000c0)={r9, 0xf422, 0x20}, 0xc) setsockopt$inet_sctp_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f00000000c0)={r9, 0x7, 0x35d9b364, 0xffffffff}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) executing program 5: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0xa) executing program 2: r0 = syz_open_dev$video(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0xf0f071, 0x2}) r1 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x2) ioctl$CEC_ADAP_S_PHYS_ADDR(r1, 0x40026102, &(0x7f0000000140)) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000000180)={'\x00', 0x0, 0x6, 0x1, 0xc43, 0x0, '\x00', '\x00', '\x00', "8000"}) executing program 2: r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000200)="0000000000000000000001000000000000000000703100"/164, 0x98) ioctl(r0, 0x1269, &(0x7f0000000100)="0100000000000000980000000000000000020000007f0000") write(0xffffffffffffffff, &(0x7f0000000300)="000000000000000000000000000000000100"/160, 0x98) ioctl(r0, 0x1269, &(0x7f0000000180)="0200000000000000980000000000000000030000007f0000") executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) read(r0, &(0x7f0000000400), 0x1) executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305029afe00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502fe9a00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305029bbe00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502be9b00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305025b7f00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305027f5b00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502993e00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305023e9900000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305025a3f00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305023f5a00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502ba7e00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305027eba00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff43050295fe00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502fe9500000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff43050294be00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502be9400000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502000000000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305027abf00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502bf7a00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305027bff00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502ff7b00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502547f00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305027f5400000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff430502553f00000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r0, &(0x7f0000000100)="ffffffffffff0211223344550806000108000604000243054305123400000000ff4305023f5500000000", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) executing program 2: syz_usb_connect(0x0, 0x35, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000040ffffffff0001010200010902200001010080320904000002000000000905010240000009058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000180)) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000200)={{{0x1}}, 0x20, 0x3e8, &(0x7f0000000240)="0123456789abcdef0123456789abcdef"}) executing program 0: r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000200)="0000000000000000000001000000000000000000703100"/164, 0x98) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x10000, 0x1}}) write(0xffffffffffffffff, &(0x7f0000000300)="000000000000000000000000000000000100"/160, 0x98) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000180)={0x2, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x0, 0x1}}) executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040790927020001000000010902270001010080320904000003ffffff00070503024000000705820240000007058402400000"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000300)={0x1, @pix={0x140, 0xf0, 0x30324c4a, 0x1}}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000400)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000500)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000600)=@mmap={0x1, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000700)=0x1) executing program 3: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)='a', 0x1}], 0x1}}], 0x1, 0x4044040) executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl(r0, 0x401c6f40, &(0x7f0000000380)="ffffffff00"/28) executing program 3: syz_usb_connect(0x0, 0x35, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100100000040ffffffff0001010200010902200001010080320904000002000000000905010240000009058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x4004550c, &(0x7f0000000180)) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000200)={{{0x1}}, 0x20, 0x3e8, &(0x7f0000000240)="0123456789abcdef0123456789abcdef"}) executing program 5: syz_usb_connect(0x0, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004012345678000101020001"], 0x0) executing program 6: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000120)={0x2, 0x47}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x31, 0x1, 'H'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x81b6, 0xbc00) nanosleep(&(0x7f0000000180)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./ttyUSB0\x00', 0x2, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)='01234567') close(r1) syz_usb_disconnect(r0) executing program 5: mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe) madvise(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x19) executing program 5: r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='nonexistent_option\x00', &(0x7f0000000080)='val\x00', 0x0) executing program 5: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) ioctl$FE_READ_SIGNAL_STRENGTH(r0, 0x80026f47, &(0x7f0000000200)) program did not crash replaying the whole log did not cause a kernel crash single: executing 9 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend-ioctl$FE_READ_SIGNAL_STRENGTH detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) ioctl$FE_READ_SIGNAL_STRENGTH(r0, 0x80026f47, &(0x7f0000000200)) program crashed: KASAN: slab-out-of-bounds Read in dvb_frontend_release single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program crashed: KASAN: use-after-free Read in dvb_frontend_release testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-nanosleep detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program did not crash testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(0x0, 0x1, 0x2) program did not crash extracting C reproducer testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release simplifying C reproducer testing compiled C program (duration=1m33.230902252s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: WARNING in dvb_frontend_release a never seen crash title: WARNING in dvb_frontend_release, ignore testing compiled C program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend program crashed: KASAN: use-after-free Read in dvb_frontend_release testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program crashed: KASAN: slab-use-after-free Read in dvb_frontend_release validation run: crashed=true testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program crashed: KASAN: slab-out-of-bounds Read in dvb_frontend_release validation run: crashed=true testing program (duration=1m33.230902252s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_open_dev$dvb_frontend detailed listing: executing program 0: syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x2) program crashed: KASAN: use-after-free Read in dvb_frontend_release validation run: crashed=true reproducing took 1h12m45.868603175s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x154/0x1550 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88805863da00 by task syz.2.22/6061 CPU: 0 UID: 0 PID: 6061 Comm: syz.2.22 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x154/0x1550 kernel/locking/mutex.c:821 dvb_frontend_release+0x1bc/0x4d0 drivers/media/dvb-core/dvb_frontend.c:2942 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] __do_fast_syscall_32+0x437/0x6a0 arch/x86/entry/syscall_32.c:294 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf701f0ec Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 RSP: 002b:00000000ffe974ec EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x5863d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 5740, tgid 5740 (kworker/1:4), ts 106640500885 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486 ___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353 __kmalloc_large_noprof+0x1a/0x90 mm/slub.c:5375 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_usb_device_init+0x122/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:281 gp8psk_usb_probe+0x56/0xc0 drivers/media/usb/dvb-usb/gp8psk.c:304 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 page last free pid 5740 tgid 5740 ts 108149694808 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:152 [inline] dvb_usb_device_exit+0x297/0x350 drivers/media/usb/dvb-usb/dvb-usb-init.c:338 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x444/0x560 drivers/base/bus.c:664 device_del+0x524/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2350 hub_port_connect drivers/usb/core/hub.c:5420 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88805863d900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805863d980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88805863da00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805863da80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805863db00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ---------------- Code disassembly (best guess): 0: 90 nop 1: 85 d2 test %edx,%edx 3: 74 0a je 0xf 5: 89 ce mov %ecx,%esi 7: 81 e6 ff 0f 00 00 and $0xfff,%esi d: 89 32 mov %esi,(%rdx) f: 85 c0 test %eax,%eax 11: 74 05 je 0x18 13: c1 e9 0c shr $0xc,%ecx 16: 89 08 mov %ecx,(%rax) 18: 31 c0 xor %eax,%eax 1a: 5e pop %rsi 1b: 5d pop %rbp 1c: c3 ret 1d: 90 nop 1e: 0f 1f 00 nopl (%rax) 21: 51 push %rcx 22: 52 push %rdx 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 58 pop %rax 3f: b8 .byte 0xb8 final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x154/0x1550 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88805863da00 by task syz.2.22/6061 CPU: 0 UID: 0 PID: 6061 Comm: syz.2.22 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x154/0x1550 kernel/locking/mutex.c:821 dvb_frontend_release+0x1bc/0x4d0 drivers/media/dvb-core/dvb_frontend.c:2942 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] __do_fast_syscall_32+0x437/0x6a0 arch/x86/entry/syscall_32.c:294 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf701f0ec Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 RSP: 002b:00000000ffe974ec EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x5863d flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 5740, tgid 5740 (kworker/1:4), ts 106640500885 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486 ___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353 __kmalloc_large_noprof+0x1a/0x90 mm/slub.c:5375 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_usb_device_init+0x122/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:281 gp8psk_usb_probe+0x56/0xc0 drivers/media/usb/dvb-usb/gp8psk.c:304 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 page last free pid 5740 tgid 5740 ts 108149694808 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:152 [inline] dvb_usb_device_exit+0x297/0x350 drivers/media/usb/dvb-usb/dvb-usb-init.c:338 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x444/0x560 drivers/base/bus.c:664 device_del+0x524/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2350 hub_port_connect drivers/usb/core/hub.c:5420 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88805863d900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805863d980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88805863da00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805863da80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805863db00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ---------------- Code disassembly (best guess): 0: 90 nop 1: 85 d2 test %edx,%edx 3: 74 0a je 0xf 5: 89 ce mov %ecx,%esi 7: 81 e6 ff 0f 00 00 and $0xfff,%esi d: 89 32 mov %esi,(%rdx) f: 85 c0 test %eax,%eax 11: 74 05 je 0x18 13: c1 e9 0c shr $0xc,%ecx 16: 89 08 mov %ecx,(%rax) 18: 31 c0 xor %eax,%eax 1a: 5e pop %rsi 1b: 5d pop %rbp 1c: c3 ret 1d: 90 nop 1e: 0f 1f 00 nopl (%rax) 21: 51 push %rcx 22: 52 push %rdx 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 58 pop %rax 3f: b8 .byte 0xb8